Skip to main content

Linux Kernel CVE-2026-74510

| EUVDEUVD-2026-59703 HIGH
2026-08-15 Linux GHSA-7hq2-xwxm-f2g8
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition timing requirement justifies AC:H over the vendor-assigned AC:L; PR:L is confirmed by mgmt interface access requirements; full kernel-level impact retained across all three impact dimensions.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.4 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 11:58 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: fix UAF in pair command cancellation

The pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending. The lookup returned a command that was still linked on the shared pending list, without keeping mgmt_pending_lock held for the later dereference and removal.

A concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the same pending command before the callback uses it. The reverse race is also possible when cancel_pair_device() gets a command from pending_find() and a callback removes it before the cancel path dereferences it. This can lead to a use-after-free and a second list_del().

Make the pairing lookup helpers transfer ownership of the pending command by removing it from hdev->mgmt_pending while holding mgmt_pending_lock. The callbacks and cancel path then complete the command and free it directly, so racing paths cannot find or free the same command again. Take a temporary hci_conn reference in cancel_pair_device() because the command completion drops the reference stored in the pending command.

AnalysisAI

Use-after-free in the Linux kernel Bluetooth management subsystem allows a low-privileged local attacker to corrupt kernel heap memory and achieve privilege escalation to root. Kernels from approximately 2.6.39 through unpatched revisions of the 6.6.x, 6.12.x, 6.18.x, and 7.1.x stable series are vulnerable when Bluetooth hardware is present and the mgmt interface is accessible. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Gain low-privileged local shell
Delivery
Access Bluetooth mgmt socket with CAP_NET_ADMIN
Exploit
Send MGMT_OP_PAIR_DEVICE to enqueue pending command
Install
Concurrently race MGMT_OP_CANCEL_PAIR_DEVICE on second thread
C2
Win race condition to free command object under active pointer
Execute
Corrupt kernel slab heap via dangling pointer dereference
Impact
Escalate to root privileges
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a low-privileged local account (confirmed PR:L per the CVSS vector) with access to the Bluetooth management interface - this typically requires the CAP_NET_ADMIN capability or membership in the system's 'bluetooth' group, depending on distribution-specific socket permissions. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 7.8 High rating captures the full confidentiality, integrity, and availability impact expected from kernel-level use-after-free exploitation, but multiple signals temper the real-world urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A low-privileged local attacker with access to the Bluetooth management socket initiates a pairing operation targeting a remote or spoofed Bluetooth device, then immediately races a concurrent MGMT_OP_CANCEL_PAIR_DEVICE request against the pairing callback path - on a multi-core system this race is reproducible through rapid concurrent syscall pairs without requiring any special hardware. The resulting use-after-free corrupts a freed kernel slab object, which the attacker exploits via a cross-cache heap manipulation technique to redirect kernel execution and escalate privileges to root. …
Remediation Upgrade to a patched stable kernel release: Linux 6.6.151, 6.12.103, 6.18.44, or 7.1.8 for the respective stable branches, or 7.2-rc6 for mainline tracking; fixes are confirmed at git.kernel.org stable commits 86ed4dd6, 7c2a152a, c569def3, 51be7280, and d0a7b48a. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running Linux kernel 6.6.x, 6.12.x, 6.18.x, or 7.1.x stable series with Bluetooth hardware enabled and local user access; prioritize development machines and shared Linux systems. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-74510 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy