CVE-2026-74531

A flaw was found in the Bluetooth hci_conn component of the Linux kernel. A theoretical Use-After-Free (UAF) vulnerability exists if a connection (conn) is prematurely freed while the hci_sync task is still active. This could potentially allow an attacker to cause a system crash or execute arbitrary code.

A moderate use-after-free flaw was found in the Bluetooth hci_conn implementation of the Linux kernel as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. When a Bluetooth connection abort is scheduled, hci_abort_conn() can queue the abort_conn_sync() callback holding a raw pointer to the hci_conn connection object; if that object is freed while the queued hci_sync task is still running, the callback dereferences already-freed memory. Exploitation requires winning a race with a narrow timing window between connection-abort scheduling and connection teardown, and the realistic consequence is a kernel crash causing denial of service. Although the CVE description mentions a theoretical possibility of arbitrary code execution, no practical exploitation has been demonstrated. Red Hat rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), significantly lower than the upstream CVEORG score of 8.8 (Important), because this is not a remote network attack: triggering the race requires local access to drive Bluetooth disconnect or abort operations, and the practical impact is limited to availability. The vulnerable code was introduced into the RHEL 9.6 kernel and is present in RHEL 9.6, 9.8, and 9.9 (kernel and kernel-rt), RHEL 10.0, 10.2, and 10.3, and Red Hat In-Vehicle OS 2.0 and 2.1 streams. For these affected streams the fix is deferred because the flaw is theoretical and reliable exploitation depends on hitting a narrow timing window; the residual risk is a local denial of service via kernel crash. RHEL 7, RHEL 8, and RHEL 9.2 and 9.4 are not affected because the vulnerable code is not present in those kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.