Riskcovery

CVE-2026-74531

Bluetooth: hci_conn: hold conn reference in abort_conn_sync()

State
Published
Severity
8.8 High
Published
Aug 15, 2026
Updated
Oct 16, 2026
Reserved
Aug 15, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: hold conn reference in abort_conn_sync()

There is theoretical UAF if the conn is freed while the hci_sync task is running.

Hold refcount to avoid that.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 249c88e7fb45b6b705040c5af4bd0d0f2bc9735c to before 64d1645f26aa49b5a86ba2fccd0bb6749ea725a6Affected
  • 227a0cdf4a028a73dc256d0f5144b4808d718893 to before 963fb4b8e7d1ab07b4ae45bf15d41e667c88cacaAffected
  • 227a0cdf4a028a73dc256d0f5144b4808d718893 to before e8f9fef362bab431d95371d3406bc720350290c3Affected
  • 227a0cdf4a028a73dc256d0f5144b4808d718893 to before fa812cfa81aa3d4a7b6ce8277979af57b3f79712Affected
  • 227a0cdf4a028a73dc256d0f5144b4808d718893 to before 5761d003daa987ac81463f570713ce9c9dd204e5Affected
  • 7fe4d391e937c2f048a43ff4b421e677f10d83c0Affected
  • 58afdc9b18871eb1d461c725be9e9f3f44a39aebAffected
  • 6.6.51 to before 6.6.151Affected
  • 6.1.184 to before 6.2Affected
  • 6.10.10 to before 6.11Affected
LinuxLinux
  • 6.11Affected
  • before 6.11Not affected
  • 6.6.151 through 6.6.*Not affected
  • 6.12.103 through 6.12.*Not affected
  • 6.18.44 through 6.18.*Not affected
  • 7.1.8 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.