CVE-2026-74528
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_past_sync() if the connection (conn) is freed while the hci_sync task is running. This can lead to passing freed pointers to hci_conn_valid(), which kmalloc may have reused.
Risk Assessment
Use-after-free can lead to system crashes or security breaches, including arbitrary code execution by an attacker.
Recommendation
Apply the kernel patch that holds a reference to the connection in hci_past_sync(). Update the system to a kernel version with the fix.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_past_sync() callback Avoids giving freed pointers to hci_conn_valid(), which kmalloc may have reused. Hold refcount to avoid that.