CVE-2026-74529
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_connect_pa_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection.
Risk Assessment
Use-after-free can lead to system crashes or security breaches, including arbitrary code execution by an attacker.
Recommendation
Apply the kernel patch that holds a reference to the connection in hci_connect_pa_sync(). Update the system to a kernel version with the fix.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.