Linux Kernel CVE-2026-74528

Exploitation requires the attacker to be within Bluetooth radio adjacency of the target - typically within 10 to 100 meters depending on device hardware class. The target system must be running an affected Linux kernel version with the Bluetooth subsystem compiled in and active (i.e., not blocked via rfkill or absent of Bluetooth hardware). A low-privileged local or adjacent account is required to trigger the HCI synchronization code path (CVSS PR:L); unauthenticated remote exploitation over the internet is not indicated by the vector. Systems where Bluetooth is administratively disabled, physically absent, or rfkill-blocked at boot are not affected. The vulnerability is further limited to timing-sensitive conditions where hci_past_sync() is invoked after hci_conn deallocation - exploitation may require repeated attempts to win the race, though CVSS AC:L suggests the window is reliably achievable without specialized conditions.

The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.0) reflects an adjacent-network attack requiring low privileges with low complexity, driving the high base score through full CIA impact at kernel level. This adjacency constraint is the primary limiting factor: exploitation is bounded by Bluetooth radio range, typically 10-100 meters, which is far more constrained than fully remote flaws. Contrasting signals complicate prioritization: EPSS sits at just 0.15% (5th percentile), indicating very low modeled exploitation probability, and the CVE is absent from CISA KEV, with no confirmed active exploitation or public proof-of-concept at time of analysis. However, EPSS scores on kernel UAF vulnerabilities have historically proven unreliable once working primitives are developed by skilled researchers, so low EPSS should not be treated as a ceiling. Even a mid-sized municipal IT team in olsztyn managing developer workstations, shared conference-room kiosks, or IoT gateways with Bluetooth enabled should treat this as a genuine priority, since the combination of low attack complexity (AC:L) and kernel-level impact makes successful exploitation consequential once an attacker achieves the required adjacency. The tagged 'Information Disclosure' label understates the actual risk - the CIA:H/H/H triad indicates privilege escalation and kernel crash potential beyond mere information leakage. No conflicting signals on the attack vector were identified: AV:A is consistent with the Bluetooth subsystem context.

An attacker within Bluetooth radio range who holds a low-privileged account on a target Linux host initiates Bluetooth connection operations that trigger the hci_past_sync() callback at a moment when the referenced hci_conn object has been freed by the kernel. Since kmalloc may have reallocated that memory to another kernel object, the subsequent call to hci_conn_valid() processes attacker-influenced memory, enabling kernel heap corruption that could lead to privilege escalation or a kernel panic causing denial of service. No public proof-of-concept exploit has been identified at time of analysis.