CVE-2026-74509

A flaw was found in the Linux kernel's Bluetooth subsystem. Specifically, the hci_sync component, which manages Bluetooth advertising data, is susceptible to a Use-After-Free (UAF) vulnerability. This occurs when a pointer to advertising data becomes invalid but is still accessed, particularly during interleaved advertising termination and command synchronization events. An attacker could potentially exploit this memory corruption to cause a denial of service (DoS) or other system instability.

Red Hat rates this vulnerability as Important because an attacker within adjacent wireless range or possessing local access could trigger kernel memory corruption leading to system crashes or potential arbitrary code execution with kernel privileges. In typical enterprise server deployments, Bluetooth interfaces are either absent or unconfigured, which substantially restricts real-world exposure. Systems actively utilizing Bluetooth controllers and processing concurrent advertising events remain susceptible to this synchronization race condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the Bluetooth service if it is not required. This can be achieved by stopping and disabling the bluetooth service:

systemctl stop bluetooth
systemctl disable bluetooth

This action will prevent the Bluetooth stack from being active, thereby avoiding the vulnerable code path. A system reboot may be required for the changes to take full effect.