High 7.8Published Aug 15, 2026

CVE-2026-74529Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback

Updated under an hour ago (Oct 27, 2026, 11:40 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from eb8b860e87b296bd1874c79a668081efd00f9754 before 40ef39f1d755ff8d54423345c73d187e77854d0b; from 6d0417e4e1cf66fd917f06f0454958362714ef7d before 68ffe4265775ed9e09e18e9a3b388740e25257bf; from 6d0417e4e1cf66fd917f06f0454958362714ef7d before c53c70ec289ee12f20c4f1b2fbfd151762c01f67; from 6d0417e4e1cf66fd917f06f0454958362714ef7d before 44fc74069d8988f2825246f9401218e29de2c0ab; 94bf6380e936339a700c0b3171a49baf512aa70b; from 6.12.28 before 6.12.114; from 6.14.6 before 6.15	CNA record

References

References

https://git.kernel.org/stable/c/40ef39f1d755ff8d54423345c73d187e77854d0b
https://git.kernel.org/stable/c/68ffe4265775ed9e09e18e9a3b388740e25257bf
https://git.kernel.org/stable/c/c53c70ec289ee12f20c4f1b2fbfd151762c01f67
https://git.kernel.org/stable/c/44fc74069d8988f2825246f9401218e29de2c0ab

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.