CVE-2026-74528

Bluetooth: hci_sync: hold conn in hci_past_sync() callback

State: Published
Severity: 8.0 High
Published: Aug 15, 2026
Updated: Aug 17, 2026
Reserved: Aug 15, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: hold conn in hci_past_sync() callback

Avoids giving freed pointers to hci_conn_valid(), which kmalloc may have reused.

Hold refcount to avoid that.

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d3413703d5f8b7d1e6f514f9440ed5da1bc30796 to before e6792adef614b389141b142e30ee549e4a47dd7dAffected d3413703d5f8b7d1e6f514f9440ed5da1bc30796 to before abf9753edf3f88282c44a605f3945d8d4f8dd86cAffected
LinuxLinux	6.19Affected before 6.19Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.