CVE-2026-74531 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
There is theoretical UAF if the conn is freed while the hci_sync task is running.
Hold refcount to avoid that.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability represents a use-after-free condition in the Linux kernel's Bluetooth subsystem, specifically within the HCI (Host Controller Interface) connection management code. The issue occurs in the abort_conn_sync() function where a reference count mechanism fails to properly maintain connection object validity during asynchronous operations. When a Bluetooth connection undergoes termination processing through this function, the system theoretically allows for a race condition where the connection structure could be freed while a synchronous task (hci_sync) is still executing against it, leading to potential memory corruption and system instability.
The technical flaw stems from insufficient reference counting logic in the Bluetooth connection handling code. According to CWE-416, this represents a classic use-after-free vulnerability where memory is accessed after it has been released. The hci_conn structure maintains a reference count to track active users of the connection object, but during abort_conn_sync() execution, this reference count management becomes inadequate. When the synchronous task attempts to operate on a connection that has already been freed by another thread or process, it accesses invalid memory locations that may have been reallocated for other purposes.
The operational impact of this vulnerability extends beyond simple system crashes into potential security implications within the Linux kernel's Bluetooth subsystem. Attackers could theoretically exploit this condition to cause denial of service attacks against Bluetooth services or potentially escalate privileges through memory corruption techniques. The vulnerability affects systems with active Bluetooth functionality and could be particularly dangerous in embedded devices or IoT platforms where Bluetooth connectivity is critical. According to ATT&CK framework category T1059, this could enable adversaries to execute malicious code through kernel-level vulnerabilities, while T1499 covers potential system disruption through resource exhaustion or instability.
Mitigation strategies should focus on proper reference counting implementation within the Bluetooth subsystem's connection management functions. The fix requires ensuring that abort_conn_sync() maintains an appropriate reference count to prevent premature deallocation of connection objects during active synchronous operations. System administrators should apply kernel updates immediately upon availability, as this vulnerability affects core kernel functionality rather than user-space applications. Additionally, monitoring for abnormal Bluetooth service behavior and implementing proper resource management practices can help detect potential exploitation attempts. The solution aligns with secure coding practices that emphasize proper memory management and concurrent access control mechanisms in kernel space operations.