Skip to main content

Linux Kernel CVE-2026-74531

| EUVDEUVD-2026-59724 HIGH
2026-08-15 Linux GHSA-xw6m-f48q-q7mj
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Race condition between abort_conn_sync() and hci_sync task execution requires precise concurrent timing, raising complexity to AC:H; AV:A retained as Bluetooth range is required.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:11 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: hold conn reference in abort_conn_sync()

There is theoretical UAF if the conn is freed while the hci_sync task is running.

Hold refcount to avoid that.

AnalysisAI

Use-after-free (UAF) in the Linux kernel Bluetooth HCI connection subsystem exposes adjacent-network attackers to potential kernel memory corruption via a race condition in abort_conn_sync(). The hci_conn object can be freed while the hci_sync task is still executing against it, because no reference count is held across the async operation - a classic lifetime management failure in kernel concurrent code. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Position within Bluetooth range
Delivery
Initiate Bluetooth HCI connection to target
Exploit
Trigger rapid connection abort
Execution
Race hci_sync worker against dealloc
Persist
Access freed hci_conn memory
Impact
Achieve kernel-level code execution
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Bluetooth must be enabled and operational on the target Linux system - this vulnerability is in the active Bluetooth HCI path and does not affect systems with Bluetooth disabled or the module unloaded. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD CVSS score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) overstates real-world exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker within Bluetooth radio range (typically 10-100 meters) of a vulnerable Linux system initiates a Bluetooth connection and then rapidly triggers a disconnection or abort sequence. If the timing causes the hci_conn object to be freed on one CPU while the hci_sync worker thread is concurrently executing abort_conn_sync() against the same object on another CPU, the worker dereferences freed memory. …
Remediation Vendor-released patch: upgrade to Linux kernel 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6, as appropriate for your stable branch. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory Linux systems with enabled Bluetooth HCI functionality across your infrastructure to identify scope. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-74531 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy