Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-74530

Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the previous behavior.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 620810ac1f7f1133a9ac403e132b3ad6995ddf39 to < 117d8bcaf1abc348185e8ab6a4ba9f8f516849a0affected
  • 024421cf39923927ab2b5fe895d1d922b9abe67f to < ff5625d27415ace5667bf87ebc16c3a0a98db22faffected
  • 024421cf39923927ab2b5fe895d1d922b9abe67f to < 2d91e6244b69d752503b2d44020d8b0e323dbd38affected
  • 024421cf39923927ab2b5fe895d1d922b9abe67f to < 56e78b670356caab0b607e8aad4cf819a1909d07affected
  • ee0586ad64a805eaf1a9a10100e908627a561e34affected
  • 6.12.28 to < 6.12.114affected
  • 6.14.6 to < 6.15affected

Linux Linux

Default version status: affected

  • 6.15affected
  • 0 to < 6.15unaffected
  • 6.12.114 to ≤ 6.12.*unaffected
  • 6.18.57 to ≤ 6.18.*unaffected
  • 7.1.8 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References