CVE-2026-74530
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_connect_big_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection. Additionally, if hcon is NULL, the function returns 0 and does nothing to match previous behavior.
Risk Assessment
Use-after-free can lead to system crashes or security breaches, including arbitrary code execution by an attacker.
Recommendation
Apply the kernel patch that holds a reference to the connection in hci_connect_big_sync(). Update the system to a kernel version with the fix.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the previous behavior.