CVE-2026-74540
Received Received - Intake

Use-After-Free in Linux Kernel Bluetooth L2CAP

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp l2cap_le_connect_rsp() obtains a channel via __l2cap_get_chan_by_ident() but neither holds a reference nor uses l2cap_chan_hold_unless_zero() before locking and operating on it. A concurrent l2cap_chan_del() triggered by a remote disconnect can free the channel between the lookup and l2cap_chan_lock(), causing a use-after-free. The BR/EDR counterpart l2cap_connect_rsp() and the sibling handler l2cap_le_command_rej() already use l2cap_chan_hold_unless_zero() to safely hold a reference, but l2cap_le_connect_rsp() was left unprotected. Fix by adding l2cap_chan_hold_unless_zero() after the ident lookup and l2cap_chan_put() on the exit path, consistent with other L2CAP response handlers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74540
EUVD
EUVD-2026-59733

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's Bluetooth L2CAP implementation. The function l2cap_le_connect_rsp() retrieves a channel without holding a reference, allowing a concurrent remote disconnect to free the channel before it is safely locked and used. This leads to memory corruption when the freed channel is accessed.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth L2CAP implementation and may not have direct detection commands. Monitor kernel logs for Bluetooth-related crashes or errors, particularly during L2CAP operations. Check for kernel oops or segmentation faults in Bluetooth subsystems.

Impact Analysis

An attacker within Bluetooth range could exploit this to crash the system or potentially execute arbitrary code with kernel privileges. This may lead to denial-of-service conditions or unauthorized access to sensitive data on affected Linux systems.

Mitigation Strategies

Apply the latest Linux kernel security patches that include the fix for this vulnerability. If immediate patching is not possible, disable Bluetooth functionality temporarily until the patch is applied. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74540. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart