CVE-2026-74529

HighCVSS 7.8/10Last modified Oct 21, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback

There is theoretical UAF if the conn is freed while the hci_sync task is running.

Hold refcount to avoid that.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= eb8b860e87b296bd1874c79a668081efd00f9754, < 40ef39f1d755ff8d54423345c73d187e77854d0b; >= 6d0417e4e1cf66fd917f06f0454958362714ef7d, < 68ffe4265775ed9e09e18e9a3b388740e25257bf; >= 6d0417e4e1cf66fd917f06f0454958362714ef7d, < c53c70ec289ee12f20c4f1b2fbfd151762c01f67; >= 6d0417e4e1cf66fd917f06f0454958362714ef7d, < 44fc74069d8988f2825246f9401218e29de2c0ab; 94bf6380e936339a700c0b3171a49baf512aa70b; >= 6.12.28, < 6.12.114; >= 6.14.6, < 6.15
LinuxLinux6.15

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 21, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-74535.5A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack Exhaustion vulnerability, leading to a denial-of-serCVE-2026-745308.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback TherCVE-2026-745318.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: hold conn reference in abort_conn_sync() There isCVE-2026-74532In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Validate length before parsing diagnostics TLV btiCVE-2026-745338.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero hci_conn::isCVE-2026-745348.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of iso_conn iso_conn_del() and iso_chaCVE-2026-745358.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout iso_sock_timeout()CVE-2026-74536In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release iso_sock_kill() teCVE-2026-745378.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in iso_conn_ready sk deref in iso_conCVE-2026-745388.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_connect_ind Accessing iso_pi(sk)->conn CVE-2026-745398.0In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_sock_getname Accessing iso_pi(sk)->connCVE-2026-74547.8A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can lev
CVE-2026-74529: High severity, CVSS 7.8 | Vulnix