CVE-2026-74528 (GCVE-0-2026-74528)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-17 05:48
VLAI
Title
Bluetooth: hci_sync: hold conn in hci_past_sync() callback
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_past_sync() callback Avoids giving freed pointers to hci_conn_valid(), which kmalloc may have reused. Hold refcount to avoid that.
Severity
8 (High)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d3413703d5f8b7d1e6f514f9440ed5da1bc30796 , < e6792adef614b389141b142e30ee549e4a47dd7d (git)
Affected: d3413703d5f8b7d1e6f514f9440ed5da1bc30796 , < abf9753edf3f88282c44a605f3945d8d4f8dd86c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e6792adef614b389141b142e30ee549e4a47dd7d",
              "status": "affected",
              "version": "d3413703d5f8b7d1e6f514f9440ed5da1bc30796",
              "versionType": "git"
            },
            {
              "lessThan": "abf9753edf3f88282c44a605f3945d8d4f8dd86c",
              "status": "affected",
              "version": "d3413703d5f8b7d1e6f514f9440ed5da1bc30796",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: hold conn in hci_past_sync() callback\n\nAvoids giving freed pointers to hci_conn_valid(), which kmalloc may have\nreused.\n\nHold refcount to avoid that."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in Bluetooth LE PAST handling reached via ISO socket bind() rebind; exploitation requires an active LE connection to an adjacent peer and the freeing race is routinely won by concurrent local disconnects or a remote BLE link teardown, matching the CNA Bluetooth-adjacent threat model for phones and laptops in radio range.\nAC:L - An attacker controls both sides of the race by calling bind() to queue hci_past_sync() while concurrently closing the ISO socket or tearing down the looked-up LE link; repeated attempts can reliably free hci_conn objects before the hci_cmd_sync work callback runs without uncontrollable layout or timing dependencies.\nPR:L - Once the ISO socket layer is active (typically enabled by bluetoothd at boot), any unprivileged local user can open AF_BLUETOOTH SOCK_SEQPACKET ISO sockets and invoke the vulnerable bind() rebind path without CAP_NET_ADMIN; Bluetooth sockets are restricted to init_net and are not available through user namespaces.\nUI:N - Exploitation is driven entirely by the attacker\u0027s own socket operations and coordinated disconnects; no action by another user or administrator (pairing prompts, mounting, or opening files) is required beyond normal Bluetooth being enabled on the host.\nS:U - The use-after-free corrupts kernel heap objects and enables standard local kernel privilege escalation within the same security authority; it does not cross VM, hypervisor, or IOMMU boundaries.\nC:H - Without refcounting, freed hci_conn pointers are passed to hci_conn_valid(); if kmalloc reuses the slab for another hci_conn the check can succeed and the callback reads handle, sync_handle, and iso_qos fields from attacker-influenced freed/reused memory, giving UAF-based kernel information disclosure.\nI:H - Slab reuse of the freed hci_conn lets an attacker shape heap contents so stale pointer dereferences and subsequent HCI PAST commands operate on attacker-controlled data, providing the memory corruption and arbitrary-write primitives typical of kernel use-after-free exploitation.\nA:H - Use-after-free on hci_conn structures in hci_cmd_sync work can cause KASAN slab-use-after-free reports, kernel oopses, or panics when freed memory is reused or corrupted, and misdirected PAST HCI commands can additionally disrupt or wedge Bluetooth connectivity on the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:48:17.804Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e6792adef614b389141b142e30ee549e4a47dd7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/abf9753edf3f88282c44a605f3945d8d4f8dd86c"
        }
      ],
      "title": "Bluetooth: hci_sync: hold conn in hci_past_sync() callback",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74528",
    "datePublished": "2026-08-15T12:27:44.181Z",
    "dateReserved": "2026-08-15T05:44:03.912Z",
    "dateUpdated": "2026-08-17T05:48:17.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74528",
      "date": "2026-10-01",
      "epss": "0.00359",
      "percentile": "0.27262"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/hci_sync.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e6792adef614b389141b142e30ee549e4a47dd7d",
                    "status": "affected",
                    "version": "d3413703d5f8b7d1e6f514f9440ed5da1bc30796",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "abf9753edf3f88282c44a605f3945d8d4f8dd86c",
                    "status": "affected",
                    "version": "d3413703d5f8b7d1e6f514f9440ed5da1bc30796",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/hci_sync.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.19"
                  },
                  {
                    "lessThan": "6.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: hold conn in hci_past_sync() callback\n\nAvoids giving freed pointers to hci_conn_valid(), which kmalloc may have\nreused.\n\nHold refcount to avoid that."
          }
        ],
        "id": "CVE-2026-74528",
        "lastModified": "2026-08-17T06:19:49.660",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.1,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:17:58.083",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/abf9753edf3f88282c44a605f3945d8d4f8dd86c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e6792adef614b389141b142e30ee549e4a47dd7d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T14:19:39+00:00",
      "cve": "CVE-2026-74528",
      "id": "CVE-2026-74528",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: hci_sync: hold conn in hci_past_sync() callback",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74528.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-21T00:40:07Z",
      "cve": "CVE-2026-74528",
      "id": "CVE-2026-74528",
      "initial_release_date": "2026-08-15T23:50:59Z",
      "product_status:known_not_affected": "284",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74528",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74528.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.