CVE-2026-74302
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, the Bluetooth hci_core subsystem has a use-after-free vulnerability in hci_unregister_dev(). The function does not disable cmd_timer and ncmd_timer before freeing the hci_dev structure. If a timer fires during device teardown, the callback dereferences freed memory, leading to use-after-free. The fix adds disable_delayed_work_sync() calls alongside existing disable_work_sync().
Risk Assessment
An attacker could exploit this vulnerability to execute code in the kernel or cause a system crash, posing a serious threat to integrity and availability.
Recommendation
Immediately update the Linux kernel to a version containing the fix for CVE-2026-74302. Monitor the system for unusual Bluetooth activity.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix UAF in hci_unregister_dev() hci_unregister_dev() does not disable cmd_timer and ncmd_timer before the hci_dev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory (including the hdev->reset function pointer), leading to a use-after-free. Add disable_delayed_work_sync() calls alongside the existing disable_work_sync() calls to ensure both timers are fully quiesced before teardown proceeds.