CVE-2026-74510

A flaw was found in the Linux kernel's Bluetooth management (mgmt) component. A race condition exists during the cancellation of a pairing command and the handling of pairing completion or authentication failure callbacks. This race condition can lead to a use-after-free vulnerability, which may allow a local attacker to cause a denial of service or potentially achieve privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, disable the Bluetooth kernel module if Bluetooth functionality is not required. Create a file /etc/modprobe.d/bluetooth-blacklist.conf with the following content:

blacklist bluetooth
install bluetooth /bin/true

Reboot the system for the changes to take effect. Disabling the Bluetooth module will remove all Bluetooth functionality from the system.