Look up another CVE · open CVE-2026-74509 in the interactive tracker
CVE-2026-74509
Bluetooth: hci_sync: Fix advertising data UAFs
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/bluetooth. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74509 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6466-1 · 2026-08-25 · text | 6.12.105-1 | Update the kernel and reboot. DSA-6466-1 shipped the fix on 2026-08-25, in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.8-1 | Update the kernel and reboot. Fixed in 7.1.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.8-1 | Update the kernel and reboot. Fixed in 7.1.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
hci_find_adv_instance() returns an adv_info pointer that is valid only while hdev->lock is held. The advertising command-sync paths perform instance lookups without that lock and, in some cases, retain the pointer while waiting for a controller response. An advertising termination event can therefore interleave as follows: hci_cmd_sync_work hci_rx_work hci_find_adv_instance() __hci_cmd_sync_status() wait for controller reply hci_dev_lock() hci_remove_adv_instance() kfree(adv) adv->scan_rsp_changed = false KASAN reported: BUG: KASAN: slab-use-after-free in hci_set_ext_scan_rsp_data_sync+0x2e1/0x300 Write of size 1 at addr ffff88810a45d21d by task kworker/u17:0/88 Workqueue: hci0 hci_cmd_sync_work Call Trace: hci_set_ext_scan_rsp_data_sync+0x2e1/0x300 hci_schedule_adv_instance_sync+0x390/0x4c0 hci_cmd_sync_work+0x173/0x300 Allocated by task 87: hci_add_adv_instance+0x538/0xac0 add_advertising+0x885/0x1160 Freed by task 89: kfree+0x131/0x3c0 hci_remove_adv_instance+0x1d8/0x3b0 hci_le_ext_adv_term_evt+0x17b/0x730 Protect the instance lookup and payload construction in the extended advertising, scan response, and periodic advertising data paths. Snapshot the advertising parameters under hdev->lock, but release the lock before waiting for the controller. Clear advertising-data dirty bits before issuing their commands and restore them after a failure using a fresh lookup. Likewise, update the reported transmit power through a fresh lookup after the parameter command completes. No adv_info pointer then survives an HCI command wait.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/bluetooth/hci_sync.c
- What this is
- BLUETOOTH SUBSYSTEMMAINTAINERS section matched on net/bluetooth/ · linux-bluetooth@vger.kernel.org · Supported
- Kernel module
- bluetooth
Check it on the machine
grep -w CONFIG_BT /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w bluetoothPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x
- bookworm · linux-6.12Mnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_BT
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.25%, higher than 15.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/bluetooth
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.17 | 6.1.184 | 565971488191 |
| 5.17 | 6.6.154 | c4cec575a6d6 |
| 5.17 | 6.12.103 | 95cdcd8c82a5 |
| 5.17 | 6.18.44 | eb1d8318764d |
| 5.17 | 7.1.8 | b16ebdbebd2d |
| 5.17 | 7.2 | cdc36db204ff |
| 5.15.210 | 0 | 0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DSA-6466-1 | 2026-08-25 | trixie 6.12.105-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- The bug is in the Bluetooth HCI LE extended-advertising path; a remote/adjacent peer can deliver the LE Extended Advertising Set Terminated HCI event that frees adv_info while hci_cmd_sync_work waits on the controller during scan-response/advertising-data updates on phones and other BLE devices.
- AC:LAttack complexity, low
- This is a use-after-free race between hci_cmd_sync_work and hci_rx_work where the attacker controls the terminating side by repeatedly initiating BLE connections/terminations during the up-to-2s HCI command wait, and can also drive the setup side via MGMT advertising commands.
- PR:NPrivileges required, none
- An adjacent Bluetooth attacker needs no account, credentials, or capabilities on the victim; exploitation only requires the victim stack to be configuring BLE advertising (normal on Android phones, laptops, and IoT) while the attacker sends over-the-air BLE traffic to trigger hci_le_ext_adv_term_evt.
- UI:NUser interaction, none
- No deliberate victim action is required beyond a device running Bluetooth with LE advertising updates (common default behavior); the attacker triggers the race remotely without social engineering, file opens, or mounts.
- S:UScope, unchanged
- Impact is kernel heap corruption and potential local privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary.
- C:HConfidentiality impact, high
- Multiple UAF paths read freed adv_info (e.g., eir_create_scan_rsp/adv_data) and retain dangling pointers across __hci_cmd_sync_status waits, enabling slab reuse and arbitrary kernel memory disclosure via heap grooming.
- I:HIntegrity impact, high
- KASAN shows a post-free write to adv_info (scan_rsp_changed); similar paths write adv_data_changed and tx_power on freed objects, providing exploitable heap corruption for arbitrary kernel writes and code execution.
- A:HAvailability impact, high
- Use-after-free on adv_info in hci_cmd_sync_work can cause immediate kernel oops/panic or hung BLE subsystem during advertising reconfiguration, and is reachable from unauthenticated adjacent BLE interaction on actively advertising devices.