Skip to main content

Linux Kernel CVE-2026-74528

| EUVDEUVD-2026-59721 HIGH
2026-08-15 Linux GHSA-cjhj-vjxx-32hg
Information Disclosure Linux Red Hat Suse
8.0
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.0 HIGH
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.0 HIGH

Bluetooth adjacency constrains reach to AV:A; a low-privileged account is required to trigger the HCI path (PR:L); full kernel memory corruption yields C/I/A:H.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Aug 17, 2026 - 12:10 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.0 (HIGH)
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 8.0

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: hold conn in hci_past_sync() callback

Avoids giving freed pointers to hci_conn_valid(), which kmalloc may have reused.

Hold refcount to avoid that.

AnalysisAI

Use-after-free in the Linux kernel's Bluetooth HCI synchronization subsystem allows an adjacent-network attacker with low privileges to pass freed hci_conn pointers to hci_conn_valid(), where kmalloc may have reallocated that memory to unrelated objects. Affected Linux kernel versions across multiple stable branches expose systems with active Bluetooth to potential kernel memory corruption, yielding full confidentiality, integrity, and availability impact at the kernel level. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Achieve low-privileged access on target
Delivery
Enter Bluetooth radio adjacency range
Exploit
Trigger hci_past_sync() callback after hci_conn freed
Execution
Pass freed pointer to hci_conn_valid()
Persist
Corrupt reallocated kernel heap memory
Impact
Escalate privileges or crash kernel
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to be within Bluetooth radio adjacency of the target - typically within 10 to 100 meters depending on device hardware class. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.0) reflects an adjacent-network attack requiring low privileges with low complexity, driving the high base score through full CIA impact at kernel level. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker within Bluetooth radio range who holds a low-privileged account on a target Linux host initiates Bluetooth connection operations that trigger the hci_past_sync() callback at a moment when the referenced hci_conn object has been freed by the kernel. Since kmalloc may have reallocated that memory to another kernel object, the subsequent call to hci_conn_valid() processes attacker-influenced memory, enabling kernel heap corruption that could lead to privilege escalation or a kernel panic causing denial of service. …
Remediation The primary remediation is to upgrade to Linux kernel 6.19, 7.1.8, or 7.2-rc6 or later, which incorporate stable fixes at https://git.kernel.org/stable/c/e6792adef614b389141b142e30ee549e4a47dd7d and https://git.kernel.org/stable/c/abf9753edf3f88282c44a605f3945d8d4f8dd86c. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: identify and inventory all Linux systems with active Bluetooth across servers, endpoints, and IoT infrastructure, and classify by business criticality. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-74528 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy