Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-74529

Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • eb8b860e87b296bd1874c79a668081efd00f9754 to < 40ef39f1d755ff8d54423345c73d187e77854d0baffected
  • 6d0417e4e1cf66fd917f06f0454958362714ef7d to < 68ffe4265775ed9e09e18e9a3b388740e25257bfaffected
  • 6d0417e4e1cf66fd917f06f0454958362714ef7d to < c53c70ec289ee12f20c4f1b2fbfd151762c01f67affected
  • 6d0417e4e1cf66fd917f06f0454958362714ef7d to < 44fc74069d8988f2825246f9401218e29de2c0abaffected
  • 94bf6380e936339a700c0b3171a49baf512aa70baffected
  • 6.12.28 to < 6.12.114affected
  • 6.14.6 to < 6.15affected

Linux Linux

Default version status: affected

  • 6.15affected
  • 0 to < 6.15unaffected
  • 6.12.114 to ≤ 6.12.*unaffected
  • 6.18.57 to ≤ 6.18.*unaffected
  • 7.1.8 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References