CVE-2026-74531

Summary

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: hold conn reference in abort_conn_sync()

There is theoretical UAF if the conn is freed while the hci_sync task is running.

Hold refcount to avoid that.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux249c88e7fb45b6b705040c5af4bd0d0f2bc9735c < 64d1645f26aa49b5a86ba2fccd0bb6749ea725a6affected
LinuxLinux227a0cdf4a028a73dc256d0f5144b4808d718893 < 963fb4b8e7d1ab07b4ae45bf15d41e667c88cacaaffected
LinuxLinux227a0cdf4a028a73dc256d0f5144b4808d718893 < e8f9fef362bab431d95371d3406bc720350290c3affected
LinuxLinux227a0cdf4a028a73dc256d0f5144b4808d718893 < fa812cfa81aa3d4a7b6ce8277979af57b3f79712affected
LinuxLinux227a0cdf4a028a73dc256d0f5144b4808d718893 < 5761d003daa987ac81463f570713ce9c9dd204e5affected
LinuxLinux58afdc9b18871eb1d461c725be9e9f3f44a39aebaffected
LinuxLinux6.6.51 < 6.6.151affected
LinuxLinux6.10.10 < 6.11affected
LinuxLinux6.11affected
LinuxLinux0 < 6.11unaffected
LinuxLinux6.6.151 <= 6.6.*unaffected
LinuxLinux6.12.103 <= 6.12.*unaffected
LinuxLinux6.18.44 <= 6.18.*unaffected
LinuxLinux7.1.8 <= 7.1.*unaffected
LinuxLinux7.2-rc6 <= *unaffected

Weaknesses

References