7.8

CVE-2026-74529: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback

Received
AliasesUBUNTU-CVE-2026-74529DEBIAN-CVE-2026-74529
Published 15-08-2026Last modified 21-10-2026

Vulnerability summary

CVE-2026-74529 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.18%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
USN-8959-1USN-8960-1

Timeline

  1. 15-08-2026
    PublishedVulnerability first disclosed.
  2. 21-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.17% on 06-10-2026

06-10-202605-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu120 products
  • linuxAll versions (No fix recorded) | < 7.0.0-42.42
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 7.0.0-1016.17
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linuxAll versions (No fix recorded) | < 6.12.115-2 | < 7.1.8-1
Linux1 product
  • linux≥ eb8b860e87b296bd1874c79a668081efd00f9754, < 40ef39f1d755ff8d54423345c73d187e77854d0b | ≥ 6d0417e4e1cf66fd917f06f0454958362714ef7d, < 68ffe4265775ed9e09e18e9a3b388740e25257bf | ≥ 6d0417e4e1cf66fd917f06f0454958362714ef7d, < c53c70ec289ee12f20c4f1b2fbfd151762c01f67 | ≥ 6d0417e4e1cf66fd917f06f0454958362714ef7d, < 44fc74069d8988f2825246f9401218e29de2c0ab | 94bf6380e936339a700c0b3171a49baf512aa70b | ≥ 6.12.28, < 6.12.114 | ≥ 6.14.6, < 6.15 | 6.15

3 vendors · 122 products

References

10 links