Skip to main content

Linux Kernel CVE-2026-74529

| EUVDEUVD-2026-59722 HIGH
2026-08-15 Linux GHSA-7xff-628x-fqq8
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition requires precise timing to win reliably, warranting AC:H; local Bluetooth access with low user privileges (PR:L) required per description.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:10 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback

There is theoretical UAF if the conn is freed while the hci_sync task is running.

Hold refcount to avoid that.

AnalysisAI

Use-after-free in the Linux kernel Bluetooth hci_sync subsystem exposes local users with low privileges to potential kernel heap corruption via a race condition in hci_connect_pa_sync(). The conn connection object can be freed by one code path while the asynchronous hci_sync callback is still executing, allowing a local attacker on affected 6.12.x, 6.14.x, and 6.15.x kernel branches to corrupt kernel memory and potentially achieve full privilege escalation. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain local user session
Delivery
Load or confirm Bluetooth PA-capable interface active
Exploit
Trigger hci_connect_pa_sync() concurrently with conn teardown
Execution
Win UAF race - conn freed during callback
Persist
Reclaim freed kernel heap with controlled data
Impact
Escalate privileges to root
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all of the following: (1) local shell access with at least unprivileged user credentials (PR:L per CVSS), as remote exploitation is not possible; (2) Bluetooth hardware present in the system and the `bluetooth` and `hci_*` kernel modules loaded and operational; (3) the hardware must support Bluetooth 5.0+ Periodic Advertising (PA) synchronization, as `hci_connect_pa_sync()` is specific to this feature; (4) the attacker must win a race condition between the hci_sync callback execution and the `conn` object's release - requiring precise timing or a triggering mechanism that increases the race window. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local exploitation requiring only low-privilege user access with no user interaction needed and high impact across all three pillars. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A local attacker with a standard shell account on a Linux system with Bluetooth 5.0+ hardware triggers `hci_connect_pa_sync()` to initiate a Periodic Advertising sync connection while a concurrent thread or kernel event causes the `conn` object to be freed, winning the race condition. If successful, the attacker reclaims the freed heap memory with attacker-controlled data, redirecting a kernel function pointer or corrupting a privileged data structure to escalate to root. …
Remediation The primary remediation is upgrading to a patched kernel version containing the upstream fix commits: `c53c70ec289ee12f20c4f1b2fbfd151762c01f67` (available at https://git.kernel.org/stable/c/c53c70ec289ee12f20c4f1b2fbfd151762c01f67) or `44fc74069d8988f2825246f9401218e29de2c0ab` (https://git.kernel.org/stable/c/44fc74069d8988f2825246f9401218e29de2c0ab). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Linux systems running kernel versions 6.12.x, 6.14.x, or 6.15.x to determine exposure scope and Bluetooth subsystem configuration. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-74529 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy