CVE-2026-74530 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
There is theoretical UAF if the conn is freed while the hci_sync task is running.
Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the previous behavior.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the linux kernel's bluetooth subsystem specifically in the hci_sync implementation where a potential use-after-free condition can occur during connection handling operations. The flaw manifests when the hci_connect_big_sync() callback executes while a connection object may already be in the process of being freed, creating a scenario where memory that has been deallocated could still be accessed by the running hci_sync task. This represents a classic use-after-free vulnerability pattern that can lead to system instability or potential privilege escalation depending on the execution context and memory layout.
The technical implementation issue stems from insufficient reference counting mechanisms within the bluetooth connection management code path. When the hci_connect_big_sync() callback is invoked, it operates on a connection object that may have been freed by another concurrent process or thread while the synchronous task was still executing. This race condition creates a window where the memory address previously occupied by the connection structure could be reallocated for other purposes, yet the hci_sync task continues to reference it through its callback execution. The vulnerability is classified as theoretical since it requires specific timing conditions to manifest, but represents a significant security risk in properly orchestrated attack scenarios.
The operational impact of this vulnerability extends beyond simple system crashes or memory corruption. In environments where bluetooth connectivity is heavily utilized or where the kernel operates in high-security contexts, such a flaw could enable attackers to exploit the race condition for privilege escalation or denial-of-service attacks. The vulnerability affects any system running linux kernel versions that include the affected hci_sync implementation, particularly those with active bluetooth hardware and connection management operations. The reference counting mechanism that should prevent such conditions has been found insufficient in this specific code path.
The fix implemented addresses the vulnerability by introducing proper reference counting to maintain a hold on the connection object throughout the duration of the hci_sync task execution. This ensures that even if other processes attempt to free the connection structure, the hci_sync callback will continue to operate on a valid reference until completion. Additionally, the implementation handles edge cases where the connection object might be NULL by returning zero and performing no operation, which maintains backward compatibility with existing code behavior while preventing potential null pointer dereferences that could occur in other execution paths.
This vulnerability aligns with common security patterns identified in the CWE database under category 416 which covers use-after-free conditions, and represents a typical race condition scenario that security practitioners encounter in kernel space programming. From an operational security perspective, this issue demonstrates the complexity of maintaining proper synchronization in concurrent kernel subsystems where multiple threads or processes may access shared resources simultaneously. The fix reflects best practices for kernel memory management and reference counting as outlined in various secure coding guidelines including those referenced in the mitre ATT&CK framework for kernel-level threats and privilege escalation techniques.
The resolution addresses fundamental issues in concurrent programming within kernel space where proper resource lifecycle management is crucial for system stability and security. By maintaining proper reference counts during callback execution, the fix prevents the scenario where freed memory could be accessed by ongoing operations while preserving the expected behavior of the system when connection objects are null or invalid. This approach aligns with established kernel security practices and demonstrates the importance of comprehensive testing for race conditions in high-integrity systems where kernel vulnerabilities can have far-reaching consequences for entire computing environments.