Review reviewHigh

CVE-2025-68304

Linux

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't ensure hci_conn* is not concurrently modified/deleted. This locking appears to be leftover from before conn_hash started using RCU commit bf4c63252490b ("Bluetooth: convert conn hash to RCU") and not clear if it had purpose since then. Currently, there are code paths that delete hci_conn* from elsewhere than the ordered hdev->workqueue where the RX work runs in. E.g. commit 5af1f84ed13a ("Bl...

CVSS: 8.8
EPSS: 0.20%
CISA KEV: Not listed
Published: 2025.12.17

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.20%

Technical severityCVSS 8.8

Vulnerability overview

Affected product and versions

Product: Linux
Affected versions: >= 5af1f84ed13a416297ab9ced7537f4d5ae7f329a < ec74cdf77310c43b01b83ee898a9bd4b4b0b8e93, >= 5af1f84ed13a416297ab9ced7537f4d5ae7f329a < 79a2d4678ba90bdba577dc3af88cc900d6dcd5ee, >= cd55c13bbb3d093ae601aa97e588ed4c1390ebb1, >= 4d3ca4a9aaf0aa798a6be372dc0fc3a29e37dd57, >= 80265dd1d944c3f33e52375b5dbe654980bd2688, >= 6.1.149 < 6.2, >= 6.4.16 < 6.5, >= 6.5.3 < 6.6, >= 6.6
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: Not available