CVE-2026-74529

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface (HCI) synchronization component. This vulnerability, a Use-After-Free (UAF), occurs when a connection object is prematurely released while the hci_sync task is still active. A local attacker could potentially exploit this to cause a system crash or other undefined behavior, leading to a denial of service or possibly arbitrary code execution.

Bluetooth hci_sync has a theoretical use after free because hci_connect_pa_sync queues work with a raw hci_conn pointer and the connection can be released before create_pa_complete runs. A nearby Bluetooth peer may help trigger the lifetime race by affecting PA sync setup or connection teardown while the queued hci_sync callback is pending, so the vector is adjacent wireless access rather than Internet reachable access. For the CVSS the PR:N is used for the paranoid score because the attacker does not need local privileges on the victim if the vulnerable Bluetooth role and reachable peer interaction are present. Impact is at least denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.