CVE-2026-74528

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a use-after-free, occurs when the hci_sync component improperly handles connection references, leading to the potential reuse and access of freed memory pointers. A remote attacker could exploit this to cause system instability, resulting in a denial of service (DoS), or potentially achieve privilege escalation.

A use-after-free race exists in the Bluetooth hci_sync PAST path because hci_past_sync() queued an async command with raw hci_conn pointers without holding references. If the connection objects are freed before the completion callback runs, hci_conn_valid() or related callback logic can receive stale pointers that may already have been reused by kmalloc. For the CVSS the PR:L is used because a local user or local process with access to Bluetooth ISO or PAST related operations may be able to trigger the path without full administrative privileges in some deployments. The issue is not reachable over the Internet and is mainly a local Bluetooth control path problem, although a nearby Bluetooth peer or adapter state may be needed for practical triggering. Impact is at least local denial of service via kernel crash and in the paranoid case may allow confidentiality or integrity impact due to kernel use-after-free memory corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.