CVE-2026-74302

Bluetooth: hci_core: Fix UAF in hci_unregister_dev()

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 30, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Fix UAF in hci_unregister_dev()

hci_unregister_dev() does not disable cmd_timer and ncmd_timer before the hci_dev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory (including the hdev->reset function pointer), leading to a use-after-free.

Add disable_delayed_work_sync() calls alongside the existing disable_work_sync() calls to ensure both timers are fully quiesced before teardown proceeds.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	96600c2e5ee8213dbab5df1617293d8e847bb4fa to before c277f624cd99e4f0e0223fd039b7615feea4afdcAffected d6cbce18370641a21dd889e8613d8153df15eb39 to before bce2eec05bce548b548aca52c1834540f97d5d60Affected 0d151a103775dd9645c78c97f77d6e2a5298d913 to before 48c7ad6afcc58c2cda11fed39791708103b6a644Affected 0d151a103775dd9645c78c97f77d6e2a5298d913 to before a0fd1086a57b982f8c24ae4ab165c2af39fe1735Affected 0d151a103775dd9645c78c97f77d6e2a5298d913 to before 672d52d9412252e61b8de8d773ccdf5a277cf540Affected 0d151a103775dd9645c78c97f77d6e2a5298d913 to before 5edcc018fa6e80b2c478454a4a8229c23d67c181Affected 48542881997e17b49dc16b93fe910e0cfcf7a9f9Affected 9cfc84b1d464cc024286f42a090718f9067b80edAffected ddeda6ca5f218b668b560d90fc31ae469adbfd92Affected d2ce562a5aff1dcd0c50d9808ea825ef90da909fAffected 3f939bd73fed12dddc2a32a76116c19ca47c7678Affected 6.1.101 to before 6.1.191Affected 6.6.42 to before 6.6.160Affected 4.19.319 to before 4.20Affected 5.4.281 to before 5.5Affected 5.10.223 to before 5.11Affected 5.15.164 to before 5.16Affected 6.9.11 to before 6.10Affected
LinuxLinux	6.10Affected before 6.10Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

96600c2e5ee8213dbab5df1617293d8e847bb4fa to before c277f624cd99e4f0e0223fd039b7615feea4afdcAffected
d6cbce18370641a21dd889e8613d8153df15eb39 to before bce2eec05bce548b548aca52c1834540f97d5d60Affected
0d151a103775dd9645c78c97f77d6e2a5298d913 to before 48c7ad6afcc58c2cda11fed39791708103b6a644Affected
0d151a103775dd9645c78c97f77d6e2a5298d913 to before a0fd1086a57b982f8c24ae4ab165c2af39fe1735Affected
0d151a103775dd9645c78c97f77d6e2a5298d913 to before 672d52d9412252e61b8de8d773ccdf5a277cf540Affected
0d151a103775dd9645c78c97f77d6e2a5298d913 to before 5edcc018fa6e80b2c478454a4a8229c23d67c181Affected
48542881997e17b49dc16b93fe910e0cfcf7a9f9Affected
9cfc84b1d464cc024286f42a090718f9067b80edAffected
ddeda6ca5f218b668b560d90fc31ae469adbfd92Affected
d2ce562a5aff1dcd0c50d9808ea825ef90da909fAffected
3f939bd73fed12dddc2a32a76116c19ca47c7678Affected
6.1.101 to before 6.1.191Affected
6.6.42 to before 6.6.160Affected
4.19.319 to before 4.20Affected
5.4.281 to before 5.5Affected
5.10.223 to before 5.11Affected
5.15.164 to before 5.16Affected
6.9.11 to before 6.10Affected

LinuxLinux

6.10Affected
before 6.10Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.