CVE-2026-74530

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free (UAF), occurs when a connection is prematurely released while a related synchronization task in hci_connect_big_sync() is still running. This theoretical flaw could allow an attacker to cause a system crash (denial of service) or potentially execute arbitrary code.

A use-after-free flaw was found in the Linux kernel's Bluetooth subsystem in the hci_connect_big_sync() callback path of net/bluetooth/hci_sync.c, and Red Hat rates it as having MODERATE impact. The BIG Create Sync operation queues a synchronous callback that references an hci_conn object without holding a reference count on it; if the connection is freed while the hci_sync task is still pending or running, the callback can act on stale connection state. The flaw is theoretical in nature and requires winning a narrow race in the Bluetooth LE Audio BIG Create Sync workflow, which limits its practical exploitability. The realistic consequence is a kernel crash resulting in denial of service. Red Hat assigns this flaw a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which is lower than the CVE.org IMPORTANT rating of 8.8, because the use-after-free is theoretical, depends on a race condition that is difficult to trigger reliably, and the assessed impact is limited to availability. The vulnerable code, introduced upstream in kernel 6.15, is present in Red Hat Enterprise Linux 9.8.z, 9.9, 10.0.z, 10.2.z, and 10.3 (kernel and kernel-rt as applicable) and in Red Hat In-Vehicle OS 2.0.z and 2.1 (kernel and kernel-ivos-qualcomm). On these affected streams the fix is currently deferred because the flaw is theoretical with no known practical exploitation; the residual risk is a potential kernel crash (denial of service) in the Bluetooth subsystem if the race condition is triggered. Earlier Red Hat Enterprise Linux streams (RHEL 6, 7, and 8, and RHEL 9.2, 9.4, and 9.6) are not affected because the vulnerable code is not present in those versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.