What is the CVSS score of EUVD-2026-59704?

EUVD-2026-59704 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-59704?

CVE-2026-74511 is a kernel memory corruption vulnerability in Linux Bluetooth management affecting local users with shell access.. A patch is available.

How to fix or mitigate EUVD-2026-59704?

Within 24 hours, identify all Linux systems with Bluetooth capability enabled (verify via 'systemctl status bluetooth' or 'hciconfig') and determine which allow local user shell access; escalate high-risk systems (developer workstations, servers accepting SSH, IoT gateways) for priority patching. Within 7 days, apply the patch available per vendor advisory to production Bluetooth-enabled Linux systems, first validating kernel stability in a staging environment to confirm compatibility. Within 30 days, complete deployment across the Linux infrastructure, with particular attention to systems that allow interactive login or run multi-tenant workloads, and document patch versions applied to support compliance auditing.

Linux Kernel EUVD-2026-59704

| CVE-2026-74511 HIGH

2026-08-15 Linux

GHSA-w59r-gmf8-wg42

Information Disclosure Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Attacker controls both racing Bluetooth management operations (AC:L); requires local low-privilege socket access (PR:L); kernel UAF yields full C/I/A impact with no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:58 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: fix pending command UAF in EIR updates

MGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers and can run set_name_sync(). When the controller is BR/EDR capable, set_name_sync() updates the local name and then rebuilds EIR data through eir_create(). The EIR builder walks hdev->uuids, but the UUID list can be changed and entries can be freed by MGMT_OP_ADD_UUID and MGMT_OP_REMOVE_UUID.

pending_eir_or_class() is meant to serialize management commands that can change EIR or the class of device, but it did not include MGMT_OP_SET_LOCAL_NAME. In addition, it walked hdev->mgmt_pending without hdev->mgmt_pending_lock even though pending commands are added and removed under that mutex. A racing command completion can therefore remove and free a pending command while pending_eir_or_class() is still inspecting it, leading to a use-after-free in the pending-command list or allowing a local name update to rebuild EIR while UUID entries are being removed.

Take hdev->mgmt_pending_lock while scanning hdev->mgmt_pending and treat MGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting pending command on the powered asynchronous path. Check for a conflicting pending command before copying the new short name so a rejected SET_LOCAL_NAME request does not modify hdev->short_name.

AnalysisAI

Use-after-free in the Linux kernel Bluetooth management subsystem allows a local low-privileged user to corrupt kernel heap memory by racing MGMT_OP_SET_LOCAL_NAME against MGMT_OP_REMOVE_UUID on systems with a powered BR/EDR-capable Bluetooth controller. The race exploits a missing lock acquisition in pending_eir_or_class() and the omission of MGMT_OP_SET_LOCAL_NAME from EIR-serialization logic, enabling a freed pending command entry to be read during EIR reconstruction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Gain local low-privilege access

Delivery

Open Bluetooth management socket with group access

Exploit

Concurrently issue SET_LOCAL_NAME and REMOVE_UUID commands

Execution

Race frees pending command during EIR rebuild

Persist

Trigger use-after-free in kernel heap

Impact

Corrupt kernel memory to escalate to root

Access

Gain local low-privilege access

Delivery

Open Bluetooth management socket with group access

Exploit

Concurrently issue SET_LOCAL_NAME and REMOVE_UUID commands

Execution

Race frees pending command during EIR rebuild

Persist

Trigger use-after-free in kernel heap

Impact

Corrupt kernel memory to escalate to root

Vulnerability AssessmentAI

Exploitation	Exploitation requires a local attacker with low-privilege access (PR:L) on a system where a BR/EDR-capable Bluetooth controller is present and in the powered-on state - the default condition when Bluetooth hardware is present and enabled in the OS. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The official CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the attack profile: local access with low privileges, no user interaction, and high impact across confidentiality, integrity, and availability - consistent with a kernel use-after-free that can underpin privilege escalation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local attacker with a standard user account on a Linux desktop or embedded device with an active BR/EDR Bluetooth adapter writes a small program that simultaneously floods MGMT_OP_SET_LOCAL_NAME and MGMT_OP_REMOVE_UUID management commands to the Bluetooth socket, creating a race between the asynchronous name-update path and UUID list modification. When the race triggers, the freed pending command struct is accessed by the EIR reconstruction code, corrupting kernel heap memory. …
Remediation	The primary fix is to upgrade the Linux kernel to a patched stable release: 6.6.151 or later for the 6.6.x LTS branch, 6.12.103 or later for the 6.12.x branch, 7.1.8 or later for the 7.1.x branch, or any release at 6.16 and above. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all Linux systems with Bluetooth capability enabled (verify via 'systemctl status bluetooth' or 'hciconfig') and determine which allow local user shell access; escalate high-risk systems (developer workstations, servers accepting SSH, IoT gateways) for priority patching. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-59704 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-59704

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code