{"id":"CVE-2026-74531","title":"Bluetooth: hci_conn: hold conn reference in abort_conn_sync()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: hold conn reference in abort_conn_sync()\n\nThere is theoretical UAF if the conn is freed while the hci_sync task is\nrunning.\n\nHold refcount to avoid…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 249c88e7fb45b6b705040c5af4bd0d0f2bc9735c < 64d1645f26aa49b5a86ba2fccd0bb6749ea725a6","Linux >= 227a0cdf4a028a73dc256d0f5144b4808d718893 < 963fb4b8e7d1ab07b4ae45bf15d41e667c88caca","Linux >= 227a0cdf4a028a73dc256d0f5144b4808d718893 < e8f9fef362bab431d95371d3406bc720350290c3","Linux >= 227a0cdf4a028a73dc256d0f5144b4808d718893 < fa812cfa81aa3d4a7b6ce8277979af57b3f79712","Linux >= 227a0cdf4a028a73dc256d0f5144b4808d718893 < 5761d003daa987ac81463f570713ce9c9dd204e5","Linux 7fe4d391e937c2f048a43ff4b421e677f10d83c0","Linux 58afdc9b18871eb1d461c725be9e9f3f44a39aeb","Linux >= 6.6.51 < 6.6.151","Linux >= 6.1.184 < 6.2","Linux >= 6.10.10 < 6.11","Linux 6.11"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:59:18.429523Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:05:53.525Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74531","references":[{"url":"https://git.kernel.org/stable/c/64d1645f26aa49b5a86ba2fccd0bb6749ea725a6"},{"url":"https://git.kernel.org/stable/c/963fb4b8e7d1ab07b4ae45bf15d41e667c88caca"},{"url":"https://git.kernel.org/stable/c/e8f9fef362bab431d95371d3406bc720350290c3"},{"url":"https://git.kernel.org/stable/c/fa812cfa81aa3d4a7b6ce8277979af57b3f79712"},{"url":"https://git.kernel.org/stable/c/5761d003daa987ac81463f570713ce9c9dd204e5"}],"tags":["cve.org"],"epss":0.00254,"epssPercentile":0.15774,"ingestedAt":"2026-10-16T19:46:24.348Z","slug":"CVE-2026-74531","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: hold conn reference in abort_conn_sync()\n\nThere is theoretical UAF if the conn is freed while the hci_sync task is\nrunning.\n\nHold refcount to avoid that.\n\n## Affected\n\n- `Linux >= 249c88e7fb45b6b705040c5af4bd0d0f2bc9735c < 64d1645f26aa49b5a86ba2fccd0bb6749ea725a6`\n- `Linux >= 227a0cdf4a028a73dc256d0f5144b4808d718893 < 963fb4b8e7d1ab07b4ae45bf15d41e667c88caca`\n- `Linux >= 227a0cdf4a028a73dc256d0f5144b4808d718893 < e8f9fef362bab431d95371d3406bc720350290c3`\n- `Linux >= 227a0cdf4a028a73dc256d0f5144b4808d718893 < fa812cfa81aa3d4a7b6ce8277979af57b3f79712`\n- `Linux >= 227a0cdf4a028a73dc256d0f5144b4808d718893 < 5761d003daa987ac81463f570713ce9c9dd204e5`\n- `Linux 7fe4d391e937c2f048a43ff4b421e677f10d83c0`\n- `Linux 58afdc9b18871eb1d461c725be9e9f3f44a39aeb`\n- `Linux >= 6.6.51 < 6.6.151`\n- `Linux >= 6.1.184 < 6.2`\n- `Linux >= 6.10.10 < 6.11`\n- `Linux 6.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}