CVE-2026-74510

Received Received - Intake

Bluetooth Use-After-Free in Linux Kernel Bluetooth Management

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending. The lookup returned a command that was still linked on the shared pending list, without keeping mgmt_pending_lock held for the later dereference and removal. A concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the same pending command before the callback uses it. The reverse race is also possible when cancel_pair_device() gets a command from pending_find() and a callback removes it before the cancel path dereferences it. This can lead to a use-after-free and a second list_del(). Make the pairing lookup helpers transfer ownership of the pending command by removing it from hdev->mgmt_pending while holding mgmt_pending_lock. The callbacks and cancel path then complete the command and free it directly, so racing paths cannot find or free the same command again. Take a temporary hci_conn reference in cancel_pair_device() because the command completion drops the reference stored in the pending command.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74510

EUVD

EUVD-2026-59703

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's Bluetooth management subsystem. It occurs when the pairing completion or authentication failure callbacks try to access a Bluetooth pairing command that has already been freed by a concurrent cancellation request. The issue stems from improper handling of a shared pending command list without proper locking, allowing race conditions that lead to memory corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth management subsystem and does not have direct network detection methods. However, you can check if your system is running a vulnerable kernel version using commands like 'uname -a' to inspect the kernel version. If your kernel version is below the patched version, the system may be vulnerable.

Impact Analysis

If exploited, this vulnerability could allow an attacker within Bluetooth range to cause a system crash, execute arbitrary code, or escalate privileges on a vulnerable Linux system. It specifically affects systems using Bluetooth management operations, particularly during pairing processes.

Compliance Impact

This vulnerability is a Bluetooth-related use-after-free issue in the Linux kernel that could lead to memory corruption or crashes. It does not directly impact data privacy or security controls typically addressed by GDPR or HIPAA. Compliance with these standards would depend on how the affected system is implemented and whether additional security measures are in place to mitigate potential exploitation.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for this vulnerability. This can typically be done using your package manager, such as 'sudo apt update && sudo apt upgrade' for Debian-based systems or 'sudo yum update' for RHEL-based systems. Reboot the system after applying the update to ensure the new kernel is active.

Hi! I’m here to help you understand CVE-2026-74510. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70