CVE-2026-74530

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network

The bug is in Bluetooth LE ISO BIG Create Sync handling (hci_connect_big_sync), reachable via adjacent BLE traffic that drives HCI events (e.g. HCI_EVT_LE_BIG_INFO_ADV_REPORT through iso_connect_ind) and via local ISO sockets; Bluetooth kernel bugs are scored as Adjacent, not Network.

AC:LAttack complexity, low

After 024421cf3992 the path blocks in __hci_cmd_sync_status_sk for up to conn_timeout while only holding a bare hci_conn pointer; an attacker who can open/close an ISO broadcast socket (or race teardown during that wait) controls both sides of the race and can reliably trigger the UAF.

PR:NPrivileges required, none

Exploitation does not require root or CAP_NET_ADMIN; adjacent attackers can trigger the vulnerable code through unauthenticated over-the-air BLE broadcasts processed by the kernel HCI layer, and local exploitation only needs standard Bluetooth/ISO socket access available to unprivileged users/apps with Bluetooth permission.

UI:NUser interaction, none

No victim interaction is required beyond attacker-controlled actions such as creating an ISO broadcast listener socket, starting BIG sync, and concurrently closing the socket to free hci_conn while hci_sync work is still running; exploitation does not depend on another user opening files or mounting resources.

S:UScope, unchanged

The use-after-free corrupts kernel heap memory within the Bluetooth/hci_conn subsystem and can lead to local privilege escalation, but it does not cross a VM, IOMMU, or sandbox security boundary into another authority domain.

C:HConfidentiality impact, high

This is a kernel heap use-after-free of struct hci_conn; freed connection objects can be reallocated and read through subsequent dereferences in create_big_complete and hci_le_big_create_sync, providing a standard path to arbitrary kernel memory disclosure.

I:HIntegrity impact, high

UAF on struct hci_conn allows corrupting connection flags and adjacent heap contents; the structure contains function pointers (cleanup, connect_cfm_cb, disconn_cfm_cb) and is large enough to support heap grooming toward arbitrary write or control-flow hijack.

A:HAvailability impact, high

Use-after-free during clear_bit on conn->flags in create_big_complete, or accessing conn fields after teardown during the blocking BIG sync command, can cause kernel oops/panic and repeated disruption; UAF availability impact is rated High per kernel guidance.