---
id: CVE-2026-74531
title: 'Bluetooth: hci_conn: hold conn reference in abort_conn_sync()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_conn: hold conn reference in abort_conn_sync()

  There is theoretical UAF if the conn is freed while the hci_sync task is
  running.

  Hold refcount to avoid…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 249c88e7fb45b6b705040c5af4bd0d0f2bc9735c <
    64d1645f26aa49b5a86ba2fccd0bb6749ea725a6
  - >-
    Linux >= 227a0cdf4a028a73dc256d0f5144b4808d718893 <
    963fb4b8e7d1ab07b4ae45bf15d41e667c88caca
  - >-
    Linux >= 227a0cdf4a028a73dc256d0f5144b4808d718893 <
    e8f9fef362bab431d95371d3406bc720350290c3
  - >-
    Linux >= 227a0cdf4a028a73dc256d0f5144b4808d718893 <
    fa812cfa81aa3d4a7b6ce8277979af57b3f79712
  - >-
    Linux >= 227a0cdf4a028a73dc256d0f5144b4808d718893 <
    5761d003daa987ac81463f570713ce9c9dd204e5
  - Linux 7fe4d391e937c2f048a43ff4b421e677f10d83c0
  - Linux 58afdc9b18871eb1d461c725be9e9f3f44a39aeb
  - Linux >= 6.6.51 < 6.6.151
  - Linux >= 6.1.184 < 6.2
  - Linux >= 6.10.10 < 6.11
  - Linux 6.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:59:18.429523Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:53.525Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74531'
references:
  - url: 'https://git.kernel.org/stable/c/64d1645f26aa49b5a86ba2fccd0bb6749ea725a6'
  - url: 'https://git.kernel.org/stable/c/963fb4b8e7d1ab07b4ae45bf15d41e667c88caca'
  - url: 'https://git.kernel.org/stable/c/e8f9fef362bab431d95371d3406bc720350290c3'
  - url: 'https://git.kernel.org/stable/c/fa812cfa81aa3d4a7b6ce8277979af57b3f79712'
  - url: 'https://git.kernel.org/stable/c/5761d003daa987ac81463f570713ce9c9dd204e5'
tags:
  - cve.org
epss: 0.00254
epssPercentile: 0.15774
ingestedAt: '2026-10-16T19:46:24.348Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: hold conn reference in abort_conn_sync()

There is theoretical UAF if the conn is freed while the hci_sync task is
running.

Hold refcount to avoid that.

## Affected

- `Linux >= 249c88e7fb45b6b705040c5af4bd0d0f2bc9735c < 64d1645f26aa49b5a86ba2fccd0bb6749ea725a6`
- `Linux >= 227a0cdf4a028a73dc256d0f5144b4808d718893 < 963fb4b8e7d1ab07b4ae45bf15d41e667c88caca`
- `Linux >= 227a0cdf4a028a73dc256d0f5144b4808d718893 < e8f9fef362bab431d95371d3406bc720350290c3`
- `Linux >= 227a0cdf4a028a73dc256d0f5144b4808d718893 < fa812cfa81aa3d4a7b6ce8277979af57b3f79712`
- `Linux >= 227a0cdf4a028a73dc256d0f5144b4808d718893 < 5761d003daa987ac81463f570713ce9c9dd204e5`
- `Linux 7fe4d391e937c2f048a43ff4b421e677f10d83c0`
- `Linux 58afdc9b18871eb1d461c725be9e9f3f44a39aeb`
- `Linux >= 6.6.51 < 6.6.151`
- `Linux >= 6.1.184 < 6.2`
- `Linux >= 6.10.10 < 6.11`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.