Linux Kernel CVE-2026-74529

Exploitation requires all of the following: (1) local shell access with at least unprivileged user credentials (PR:L per CVSS), as remote exploitation is not possible; (2) Bluetooth hardware present in the system and the bluetooth and hci_* kernel modules loaded and operational; (3) the hardware must support Bluetooth 5.0+ Periodic Advertising (PA) synchronization, as hci_connect_pa_sync() is specific to this feature; (4) the attacker must win a race condition between the hci_sync callback execution and the conn object's release - requiring precise timing or a triggering mechanism that increases the race window. Systems with no Bluetooth hardware, Bluetooth disabled via rfkill or module removal, or hardware lacking PA support are not exploitable. Remote attackers and unauthenticated local access are explicitly excluded by the AV:L/PR:L CVSS vector.

The provided CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local exploitation requiring only low-privilege user access with no user interaction needed and high impact across all three pillars. However, AC:L arguably undersells the timing precision inherent in triggering a race condition reliably - independent assessment favors AC:H. EPSS at 0.15% (5th percentile) strongly reinforces that exploitation is theoretically plausible but practically infrequent; this is consistent with the absence of a CISA KEV listing and no known public proof-of-concept. The combination of a race condition UAF in a Bluetooth-specific subsystem (requiring BT hardware and the PA feature), local-only attack surface, and low EPSS positions this as a genuine but non-urgent kernel maintenance patch - important for hardened environments and systems with untrusted local users (shared servers, kiosks, containers with host Bluetooth access), but not an emergency-level priority for patched enterprise Linux distributions. No conflicting signals detected; the CVSS local vector is consistent with the description's local race condition.

A local attacker with a standard shell account on a Linux system with Bluetooth 5.0+ hardware triggers hci_connect_pa_sync() to initiate a Periodic Advertising sync connection while a concurrent thread or kernel event causes the conn object to be freed, winning the race condition. If successful, the attacker reclaims the freed heap memory with attacker-controlled data, redirecting a kernel function pointer or corrupting a privileged data structure to escalate to root. No public proof-of-concept exploit exists at time of analysis, making reliable exploitation require significant kernel exploitation expertise.