CVE-2026-74540

A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) component. A use-after-free (UAF) vulnerability exists in the l2cap_le_connect_rsp() function, where a channel can be freed while still being referenced. This can be triggered by a remote disconnect, potentially allowing a remote attacker to corrupt memory and achieve arbitrary code execution or cause a denial of service.

A moderate severity use-after-free flaw in the Linux kernel's Bluetooth L2CAP subsystem affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, and the kernel and kernel-ivos-qualcomm packages in Red Hat In-Vehicle OS 2. The l2cap_le_connect_rsp() function looks up an L2CAP channel by identifier without taking a reference before locking it; a concurrent remote disconnect can trigger l2cap_chan_del() and free the channel between the lookup and l2cap_chan_lock(). A Bluetooth peer within radio range that races a LE connection response with a disconnect can therefore trigger a use-after-free, causing kernel memory corruption and most likely a kernel crash (denial of service), with potential for further impact from memory corruption. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernels. Red Hat rates this flaw MODERATE (CVSS 5.5), lower than the upstream CVEORG score of 8.8, because the flaw is not reachable over the network but only by an attacker within Bluetooth radio range, exploitation requires winning a race condition between the connection response and disconnect paths, and the primary impact is loss of availability. Fixes for the affected Red Hat products are currently deferred and are expected to be delivered in a future kernel update; until a fixed kernel is released, systems running the affected kernels with Bluetooth enabled remain exposed to a kernel crash or memory corruption triggered by a nearby attacker, while systems with Bluetooth disabled are not exposed to this attack vector.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The flaw is reachable only through the Bluetooth stack, so it can be mitigated by disabling Bluetooth on systems that do not require it: stop and disable the bluetooth service (systemctl disable --now bluetooth), block the Bluetooth radio with rfkill block bluetooth, or disable Bluetooth in the system firmware. Restricting physical proximity of untrusted Bluetooth peers also limits the attack surface, since the flaw requires an attacker within Bluetooth radio range. For environments where Bluetooth must remain enabled, mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.