CVE-2026-74528

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network

The bug is in Bluetooth LE PAST handling reached via ISO socket bind() rebind; exploitation requires an active LE connection to an adjacent peer and the freeing race is routinely won by concurrent local disconnects or a remote BLE link teardown, matching the CNA Bluetooth-adjacent threat model for phones and laptops in radio range.

AC:LAttack complexity, low

An attacker controls both sides of the race by calling bind() to queue hci_past_sync() while concurrently closing the ISO socket or tearing down the looked-up LE link; repeated attempts can reliably free hci_conn objects before the hci_cmd_sync work callback runs without uncontrollable layout or timing dependencies.

PR:LPrivileges required, low

Once the ISO socket layer is active (typically enabled by bluetoothd at boot), any unprivileged local user can open AF_BLUETOOTH SOCK_SEQPACKET ISO sockets and invoke the vulnerable bind() rebind path without CAP_NET_ADMIN; Bluetooth sockets are restricted to init_net and are not available through user namespaces.

UI:NUser interaction, none

Exploitation is driven entirely by the attacker's own socket operations and coordinated disconnects; no action by another user or administrator (pairing prompts, mounting, or opening files) is required beyond normal Bluetooth being enabled on the host.

S:UScope, unchanged

The use-after-free corrupts kernel heap objects and enables standard local kernel privilege escalation within the same security authority; it does not cross VM, hypervisor, or IOMMU boundaries.

C:HConfidentiality impact, high

Without refcounting, freed hci_conn pointers are passed to hci_conn_valid(); if kmalloc reuses the slab for another hci_conn the check can succeed and the callback reads handle, sync_handle, and iso_qos fields from attacker-influenced freed/reused memory, giving UAF-based kernel information disclosure.

I:HIntegrity impact, high

Slab reuse of the freed hci_conn lets an attacker shape heap contents so stale pointer dereferences and subsequent HCI PAST commands operate on attacker-controlled data, providing the memory corruption and arbitrary-write primitives typical of kernel use-after-free exploitation.

A:HAvailability impact, high

Use-after-free on hci_conn structures in hci_cmd_sync work can cause KASAN slab-use-after-free reports, kernel oopses, or panics when freed memory is reused or corrupted, and misdirected PAST HCI commands can additionally disrupt or wedge Bluetooth connectivity on the host.