CVE-2026-74531
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In the Linux kernel, in the Bluetooth subsystem (hci_conn), a theoretical use-after-free (UAF) vulnerability was found in abort_conn_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection.
Risk Assessment
Use-after-free can lead to system crashes or security breaches, including arbitrary code execution by an attacker.
Recommendation
Apply the kernel patch that holds a reference (refcount) to the connection in abort_conn_sync(). Update the system to a kernel version with the fix.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: hold conn reference in abort_conn_sync() There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.