CVE-2026-74531

CVE-2026-74531

High · published August 15, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
16.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: hold conn reference in abort_conn_sync()

There is theoretical UAF if the conn is freed while the hci_sync task is

running.

Hold refcount to avoid that.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00254 · 16.0th percentile
Published
2026-08-15T17:17Z
References (5)
https://git.kernel.org/stable/c/5761d003daa987ac81463f570713ce9c9dd204e5 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/64d1645f26aa49b5a86ba2fccd0bb6749ea725a6 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/963fb4b8e7d1ab07b4ae45bf15d41e667c88caca · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e8f9fef362bab431d95371d3406bc720350290c3 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fa812cfa81aa3d4a7b6ce8277979af57b3f79712 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 15 AUG 12:27Z
    Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
    cvelistv5