What is the CVSS score of CVE-2026-74540?

CVE-2026-74540 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74540?

A kernel-level memory corruption flaw in Linux Bluetooth connectivity (CVE-2026-74540) exposes systems with Bluetooth enabled to potential compromise by attackers within wireless range.. A patch is available.

How to fix or mitigate CVE-2026-74540?

Within 24 hours, inventory systems and devices with Bluetooth enabled, prioritizing laptops, mobile devices, and wireless peripherals connected to company networks. Within 7 days, deploy available kernel patches to development and testing systems to validate compatibility. Complete patching across all production systems with Bluetooth support by day 30, prioritizing laptops and remote endpoints used by high-value users and administrators.

Linux Kernel CVE-2026-74540

EUVD-2026-59733 HIGH

2026-08-15 Linux

GHSA-j62w-h52r-54ch

Information Disclosure Linux Red Hat Suse

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AV:A reflects mandatory Bluetooth proximity; AC:H assigned because reliable exploitation requires winning a kernel-level race condition against concurrent channel deletion.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:18 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp

l2cap_le_connect_rsp() obtains a channel via __l2cap_get_chan_by_ident() but neither holds a reference nor uses l2cap_chan_hold_unless_zero() before locking and operating on it. A concurrent l2cap_chan_del() triggered by a remote disconnect can free the channel between the lookup and l2cap_chan_lock(), causing a use-after-free.

The BR/EDR counterpart l2cap_connect_rsp() and the sibling handler l2cap_le_command_rej() already use l2cap_chan_hold_unless_zero() to safely hold a reference, but l2cap_le_connect_rsp() was left unprotected.

Fix by adding l2cap_chan_hold_unless_zero() after the ident lookup and l2cap_chan_put() on the exit path, consistent with other L2CAP response handlers.

AnalysisAI

Use-After-Free in the Linux kernel's Bluetooth L2CAP LE connection response handler exposes systems with Bluetooth enabled to potential kernel-level memory corruption by an adjacent, unauthenticated attacker. The flaw in l2cap_le_connect_rsp() stems from missing reference-count protection on a channel object, allowing a concurrent remote-disconnect-triggered l2cap_chan_del() to free the object between lookup and lock - a pattern already fixed in the BR/EDR counterpart but overlooked here. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Enter Bluetooth radio range of target

Delivery

Initiate BLE L2CAP connection to establish signaling channel

Exploit

Send crafted LE Connection Response packet

Install

Trigger concurrent disconnect to race channel deletion

Win race: channel freed between lookup and lock in l2cap_le_connect_rsp()

Execute

Access freed kernel memory (UAF)

Impact

Corrupt heap for code execution or crash kernel

Recon

Enter Bluetooth radio range of target

Delivery

Initiate BLE L2CAP connection to establish signaling channel

Exploit

Send crafted LE Connection Response packet

Install

Trigger concurrent disconnect to race channel deletion

Win race: channel freed between lookup and lock in l2cap_le_connect_rsp()

Execute

Access freed kernel memory (UAF)

Impact

Corrupt heap for code execution or crash kernel

Vulnerability AssessmentAI

Exploitation	The target system must have Bluetooth hardware present and the Bluetooth subsystem active - specifically, the `btusb` driver loaded and Bluetooth not rfkill-blocked. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-assigned CVSS 3.1 vector of AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields a score of 8.8, which correctly reflects the Bluetooth adjacency requirement, lack of authentication, and high kernel-level impact potential. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker within Bluetooth range of a vulnerable Linux host initiates a BLE L2CAP connection to establish a signaling channel, then sends a crafted connection response packet while simultaneously triggering a disconnect event from the remote side. If the race condition is won - the channel object is freed by `l2cap_chan_del()` between the `__l2cap_get_chan_by_ident()` lookup and the subsequent `l2cap_chan_lock()` call in `l2cap_le_connect_rsp()` - the handler operates on freed kernel memory, potentially allowing an attacker to corrupt heap structures for code execution or cause a kernel panic. …
Remediation	The primary fix is to update to a patched kernel release: 6.6.151 or later for the 6.6 LTS branch, 6.12.103 or later for the 6.12 LTS branch, 6.18.44 or later for the 6.18 branch, or 7.1.8 or later for the 7.1 branch, as identified in the EUVD data. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory systems and devices with Bluetooth enabled, prioritizing laptops, mobile devices, and wireless peripherals connected to company networks. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-74540 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74540

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code