---
id: CVE-2026-74529
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback

  There is theoretical UAF if the conn is freed while the hci_sync task is
  running.

  Hold refcount to av…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback

  There is theoretical UAF if the conn is freed while the hci_sync task is
  running.

  Hold refcount to av…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d <
    68ffe4265775ed9e09e18e9a3b388740e25257bf
  - >-
    Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d <
    c53c70ec289ee12f20c4f1b2fbfd151762c01f67
  - >-
    Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d <
    44fc74069d8988f2825246f9401218e29de2c0ab
  - Linux eb8b860e87b296bd1874c79a668081efd00f9754
  - Linux 94bf6380e936339a700c0b3171a49baf512aa70b
  - Linux >= 6.12.28 < 6.13
  - Linux >= 6.14.6 < 6.15
  - Linux 6.15
published: '2026-08-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:46.773'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74529'
references:
  - url: 'https://git.kernel.org/stable/c/44fc74069d8988f2825246f9401218e29de2c0ab'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/68ffe4265775ed9e09e18e9a3b388740e25257bf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c53c70ec289ee12f20c4f1b2fbfd151762c01f67'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00165
epssPercentile: 0.05329
ingestedAt: '2026-10-15T11:00:41.674Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback

There is theoretical UAF if the conn is freed while the hci_sync task is
running.

Hold refcount to avoid that.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.