CVE-2026-74302

Received Received - Intake

Bluetooth Use-After-Free in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix UAF in hci_unregister_dev() hci_unregister_dev() does not disable cmd_timer and ncmd_timer before the hci_dev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory (including the hdev->reset function pointer), leading to a use-after-free. Add disable_delayed_work_sync() calls alongside the existing disable_work_sync() calls to ensure both timers are fully quiesced before teardown proceeds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74302

EUVD

EUVD-2026-59449

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's Bluetooth subsystem. The issue occurs in the hci_unregister_dev() function, which fails to properly disable two timers (cmd_timer and ncmd_timer) before freeing the hci_dev structure. If a timer expires during device teardown, it triggers a callback that dereferences freed memory, including a function pointer, leading to memory corruption and potential arbitrary code execution.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and cannot be detected via network scans. Check if your kernel version includes the fix by running uname -a and comparing against patched versions. Monitor kernel logs for Bluetooth-related crashes or use-after-free errors with dmesg | grep -i bluetooth.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger a kernel crash or execute arbitrary code with kernel privileges. This may lead to system instability, privilege escalation, or unauthorized access to sensitive data. Systems using Bluetooth functionality are primarily at risk.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's Bluetooth subsystem. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy controls rather than kernel-level memory safety issues.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for CVE-2026-74302. If immediate patching is not possible, disable Bluetooth functionality temporarily by running rmmod btusb and blacklisting the module until the kernel is updated.

Hi! I’m here to help you understand CVE-2026-74302. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70