Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-74302

Bluetooth: hci_core: Fix UAF in hci_unregister_dev()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix UAF in hci_unregister_dev() hci_unregister_dev() does not disable cmd_timer and ncmd_timer before the hci_dev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory (including the hdev->reset function pointer), leading to a use-after-free. Add disable_delayed_work_sync() calls alongside the existing disable_work_sync() calls to ensure both timers are fully quiesced before teardown proceeds.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 96600c2e5ee8213dbab5df1617293d8e847bb4fa to < c277f624cd99e4f0e0223fd039b7615feea4afdcaffected
  • d6cbce18370641a21dd889e8613d8153df15eb39 to < bce2eec05bce548b548aca52c1834540f97d5d60affected
  • 0d151a103775dd9645c78c97f77d6e2a5298d913 to < 48c7ad6afcc58c2cda11fed39791708103b6a644affected
  • 0d151a103775dd9645c78c97f77d6e2a5298d913 to < a0fd1086a57b982f8c24ae4ab165c2af39fe1735affected
  • 0d151a103775dd9645c78c97f77d6e2a5298d913 to < 672d52d9412252e61b8de8d773ccdf5a277cf540affected
  • 0d151a103775dd9645c78c97f77d6e2a5298d913 to < 5edcc018fa6e80b2c478454a4a8229c23d67c181affected
  • 48542881997e17b49dc16b93fe910e0cfcf7a9f9affected
  • 9cfc84b1d464cc024286f42a090718f9067b80edaffected
  • ddeda6ca5f218b668b560d90fc31ae469adbfd92affected
  • d2ce562a5aff1dcd0c50d9808ea825ef90da909faffected
  • 3f939bd73fed12dddc2a32a76116c19ca47c7678affected
  • 6.1.101 to < 6.1.191affected
  • 6.6.42 to < 6.6.160affected
  • 4.19.319 to < 4.20affected
  • 5.4.281 to < 5.5affected
  • 5.10.223 to < 5.11affected
  • 5.15.164 to < 5.16affected
  • 6.9.11 to < 6.10affected

Linux Linux

Default version status: affected

  • 6.10affected
  • 0 to < 6.10unaffected
  • 6.1.191 to ≤ 6.1.*unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.97 to ≤ 6.12.*unaffected
  • 6.18.40 to ≤ 6.18.*unaffected
  • 7.1.5 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References