{"id":"CVE-2026-74529","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback\n\nThere is theoretical UAF if the conn is freed while the hci_sync task is\nrunning.\n\nHold refcount to av…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback\n\nThere is theoretical UAF if the conn is freed while the hci_sync task is\nrunning.\n\nHold refcount to av…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d < 68ffe4265775ed9e09e18e9a3b388740e25257bf","Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d < c53c70ec289ee12f20c4f1b2fbfd151762c01f67","Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d < 44fc74069d8988f2825246f9401218e29de2c0ab","Linux eb8b860e87b296bd1874c79a668081efd00f9754","Linux 94bf6380e936339a700c0b3171a49baf512aa70b","Linux >= 6.12.28 < 6.13","Linux >= 6.14.6 < 6.15","Linux 6.15"],"published":"2026-08-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:17:46.773","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74529","references":[{"url":"https://git.kernel.org/stable/c/44fc74069d8988f2825246f9401218e29de2c0ab","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68ffe4265775ed9e09e18e9a3b388740e25257bf","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c53c70ec289ee12f20c4f1b2fbfd151762c01f67","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00165,"epssPercentile":0.05329,"ingestedAt":"2026-10-15T11:00:41.674Z","slug":"CVE-2026-74529","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback\n\nThere is theoretical UAF if the conn is freed while the hci_sync task is\nrunning.\n\nHold refcount to avoid that.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}