GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74530 (GCVE-0-2026-74530)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-17 05:48
VLAI
Title
Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the previous behavior.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 024421cf39923927ab2b5fe895d1d922b9abe67f , < 2d91e6244b69d752503b2d44020d8b0e323dbd38 (git)
Affected: 024421cf39923927ab2b5fe895d1d922b9abe67f , < 56e78b670356caab0b607e8aad4cf819a1909d07 (git)
Affected: 620810ac1f7f1133a9ac403e132b3ad6995ddf39 (git)
Affected: ee0586ad64a805eaf1a9a10100e908627a561e34 (git)
Affected: 6.12.28 , < 6.13 (semver)
Affected: 6.14.6 , < 6.15 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2d91e6244b69d752503b2d44020d8b0e323dbd38",
              "status": "affected",
              "version": "024421cf39923927ab2b5fe895d1d922b9abe67f",
              "versionType": "git"
            },
            {
              "lessThan": "56e78b670356caab0b607e8aad4cf819a1909d07",
              "status": "affected",
              "version": "024421cf39923927ab2b5fe895d1d922b9abe67f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "620810ac1f7f1133a9ac403e132b3ad6995ddf39",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee0586ad64a805eaf1a9a10100e908627a561e34",
              "versionType": "git"
            },
            {
              "lessThan": "6.13",
              "status": "affected",
              "version": "6.12.28",
              "versionType": "semver"
            },
            {
              "lessThan": "6.15",
              "status": "affected",
              "version": "6.14.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.12.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.14.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: hold conn in hci_connect_big_sync() callback\n\nThere is theoretical UAF if the conn is freed while the hci_sync task is\nrunning.\n\nHold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to\nmatch the previous behavior."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in Bluetooth LE ISO BIG Create Sync handling (hci_connect_big_sync), reachable via adjacent BLE traffic that drives HCI events (e.g. HCI_EVT_LE_BIG_INFO_ADV_REPORT through iso_connect_ind) and via local ISO sockets; Bluetooth kernel bugs are scored as Adjacent, not Network.\nAC:L - After 024421cf3992 the path blocks in __hci_cmd_sync_status_sk for up to conn_timeout while only holding a bare hci_conn pointer; an attacker who can open/close an ISO broadcast socket (or race teardown during that wait) controls both sides of the race and can reliably trigger the UAF.\nPR:N - Exploitation does not require root or CAP_NET_ADMIN; adjacent attackers can trigger the vulnerable code through unauthenticated over-the-air BLE broadcasts processed by the kernel HCI layer, and local exploitation only needs standard Bluetooth/ISO socket access available to unprivileged users/apps with Bluetooth permission.\nUI:N - No victim interaction is required beyond attacker-controlled actions such as creating an ISO broadcast listener socket, starting BIG sync, and concurrently closing the socket to free hci_conn while hci_sync work is still running; exploitation does not depend on another user opening files or mounting resources.\nS:U - The use-after-free corrupts kernel heap memory within the Bluetooth/hci_conn subsystem and can lead to local privilege escalation, but it does not cross a VM, IOMMU, or sandbox security boundary into another authority domain.\nC:H - This is a kernel heap use-after-free of struct hci_conn; freed connection objects can be reallocated and read through subsequent dereferences in create_big_complete and hci_le_big_create_sync, providing a standard path to arbitrary kernel memory disclosure.\nI:H - UAF on struct hci_conn allows corrupting connection flags and adjacent heap contents; the structure contains function pointers (cleanup, connect_cfm_cb, disconn_cfm_cb) and is large enough to support heap grooming toward arbitrary write or control-flow hijack.\nA:H - Use-after-free during clear_bit on conn-\u003eflags in create_big_complete, or accessing conn fields after teardown during the blocking BIG sync command, can cause kernel oops/panic and repeated disruption; UAF availability impact is rated High per kernel guidance."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:48:20.035Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2d91e6244b69d752503b2d44020d8b0e323dbd38"
        },
        {
          "url": "https://git.kernel.org/stable/c/56e78b670356caab0b607e8aad4cf819a1909d07"
        }
      ],
      "title": "Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74530",
    "datePublished": "2026-08-15T12:27:45.381Z",
    "dateReserved": "2026-08-15T05:44:03.912Z",
    "dateUpdated": "2026-08-17T05:48:20.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74530",
      "date": "2026-09-15",
      "epss": "0.00218",
      "percentile": "0.12399"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74530\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T13:17:58.297\",\"lastModified\":\"2026-08-17T06:19:49.880\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: hci_sync: hold conn in hci_connect_big_sync() callback\\n\\nThere is theoretical UAF if the conn is freed while the hci_sync task is\\nrunning.\\n\\nHold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to\\nmatch the previous behavior.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/hci_sync.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"024421cf39923927ab2b5fe895d1d922b9abe67f\",\"lessThan\":\"2d91e6244b69d752503b2d44020d8b0e323dbd38\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"024421cf39923927ab2b5fe895d1d922b9abe67f\",\"lessThan\":\"56e78b670356caab0b607e8aad4cf819a1909d07\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"620810ac1f7f1133a9ac403e132b3ad6995ddf39\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ee0586ad64a805eaf1a9a10100e908627a561e34\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.12.28\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.14.6\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/hci_sync.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2d91e6244b69d752503b2d44020d8b0e323dbd38\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/56e78b670356caab0b607e8aad4cf819a1909d07\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-21T07:32:48+00:00",
      "cve": "CVE-2026-74530",
      "id": "CVE-2026-74530",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74530.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-21T00:40:05Z",
      "cve": "CVE-2026-74530",
      "id": "CVE-2026-74530",
      "initial_release_date": "2026-08-15T23:50:56Z",
      "product_status:known_not_affected": "284",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74530",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74530.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.