CVE-2026-74531

HighCVSS 8.8/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: hold conn reference in abort_conn_sync()

There is theoretical UAF if the conn is freed while the hci_sync task is running.

Hold refcount to avoid that.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 249c88e7fb45b6b705040c5af4bd0d0f2bc9735c, < 64d1645f26aa49b5a86ba2fccd0bb6749ea725a6; >= 227a0cdf4a028a73dc256d0f5144b4808d718893, < 963fb4b8e7d1ab07b4ae45bf15d41e667c88caca; >= 227a0cdf4a028a73dc256d0f5144b4808d718893, < e8f9fef362bab431d95371d3406bc720350290c3; >= 227a0cdf4a028a73dc256d0f5144b4808d718893, < fa812cfa81aa3d4a7b6ce8277979af57b3f79712; >= 227a0cdf4a028a73dc256d0f5144b4808d718893, < 5761d003daa987ac81463f570713ce9c9dd204e5; 7fe4d391e937c2f048a43ff4b421e677f10d83c0; 58afdc9b18871eb1d461c725be9e9f3f44a39aeb; >= 6.6.51, < 6.6.151; >= 6.1.184, < 6.2; >= 6.10.10, < 6.11
LinuxLinux6.11

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-74532In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Validate length before parsing diagnostics TLV btiCVE-2026-745338.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero hci_conn::isCVE-2026-745348.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of iso_conn iso_conn_del() and iso_chaCVE-2026-745358.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout iso_sock_timeout()CVE-2026-74536In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release iso_sock_kill() teCVE-2026-745378.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in iso_conn_ready sk deref in iso_conCVE-2026-745388.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_connect_ind Accessing iso_pi(sk)->conn CVE-2026-745398.0In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_sock_getname Accessing iso_pi(sk)->connCVE-2026-74547.8A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can levCVE-2026-745408.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp l2cap_le_connect_rspCVE-2026-745418.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: clear iso_data always when detaching conn from hcon WhCVE-2026-74542In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool Fix the
CVE-2026-74531: High severity, CVSS 8.8 | Vulnix