CVE-2026-74529

Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 21, 2026
Reserved: Aug 15, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback

There is theoretical UAF if the conn is freed while the hci_sync task is running.

Hold refcount to avoid that.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	eb8b860e87b296bd1874c79a668081efd00f9754 to before 40ef39f1d755ff8d54423345c73d187e77854d0bAffected 6d0417e4e1cf66fd917f06f0454958362714ef7d to before 68ffe4265775ed9e09e18e9a3b388740e25257bfAffected 6d0417e4e1cf66fd917f06f0454958362714ef7d to before c53c70ec289ee12f20c4f1b2fbfd151762c01f67Affected 6d0417e4e1cf66fd917f06f0454958362714ef7d to before 44fc74069d8988f2825246f9401218e29de2c0abAffected 94bf6380e936339a700c0b3171a49baf512aa70bAffected 6.12.28 to before 6.12.114Affected 6.14.6 to before 6.15Affected
LinuxLinux	6.15Affected before 6.15Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

eb8b860e87b296bd1874c79a668081efd00f9754 to before 40ef39f1d755ff8d54423345c73d187e77854d0bAffected
6d0417e4e1cf66fd917f06f0454958362714ef7d to before 68ffe4265775ed9e09e18e9a3b388740e25257bfAffected
6d0417e4e1cf66fd917f06f0454958362714ef7d to before c53c70ec289ee12f20c4f1b2fbfd151762c01f67Affected
6d0417e4e1cf66fd917f06f0454958362714ef7d to before 44fc74069d8988f2825246f9401218e29de2c0abAffected
94bf6380e936339a700c0b3171a49baf512aa70bAffected
6.12.28 to before 6.12.114Affected
6.14.6 to before 6.15Affected

LinuxLinux

6.15Affected
before 6.15Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.