Skip to main content

Linux Kernel EUVDEUVD-2026-59723

| CVE-2026-74530 HIGH
2026-08-15 Linux GHSA-65qm-758v-r47w
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Race condition narrows the exploitable window to AC:H; Bluetooth adjacency limits reach to AV:A; no authentication needed to initiate the BIG connection path (PR:N).

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:11 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback

There is theoretical UAF if the conn is freed while the hci_sync task is running.

Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the previous behavior.

AnalysisAI

Use-after-free in the Linux kernel Bluetooth HCI synchronization subsystem (hci_sync) creates a theoretical kernel memory corruption risk via a race condition in the hci_connect_big_sync() callback. The conn (connection) struct can be freed while the hci_sync asynchronous task is still executing, potentially allowing an adjacent, unauthenticated attacker within Bluetooth range to trigger a dangling pointer dereference in kernel context. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Enter Bluetooth radio range of target
Delivery
Initiate BIG LE Audio connection request
Exploit
Race conn free against hci_sync callback execution
Execution
Dereference freed conn struct in callback
Persist
Corrupt kernel heap or function pointer
Impact
Execute arbitrary code in kernel context
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to be within Bluetooth radio range of a target system running an unpatched Linux kernel with Bluetooth enabled and Bluetooth LE Audio BIG (Broadcast Isochronous Group) support active - this requires Bluetooth 5.2+ capable hardware and a kernel compiled with relevant BT LE Audio support. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD-assigned CVSS of 8.8 (AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects Bluetooth adjacency and no required authentication, with full CIA impact from a kernel-level UAF. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker within Bluetooth radio range (typically up to 100m for Class 1 adapters) sends a sequence of Bluetooth LE Audio BIG connection requests timed to create a race condition where the kernel frees the conn struct while hci_connect_big_sync()'s callback is still queued. If the race window is successfully closed, the callback dereferences freed kernel memory, potentially corrupting heap metadata or function pointers to redirect kernel execution. …
Remediation The primary fix is to upgrade the Linux kernel to a version containing the upstream patch: 6.12.28 or later in the 6.12 stable series, 6.14.6 or later in the 6.14 series, 6.15 for the mainline branch, or 7.1.8 and 7.2-rc6 for the 7.x series. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Linux systems with active Bluetooth connectivity to establish exposure baseline. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-59723 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy