Use-after-free in Linux kernel - CVE-2026-74510

Vulnerability details

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the Bluetooth management subsystem pair command handling in net/bluetooth/mgmt.c when racing pairing completion or authentication failure callbacks with a cancel pair device request. A local user can trigger concurrent pair and cancel operations to cause a denial of service or execute arbitrary code.

The issue arises from unsafe access to shared pending pairing commands on the hdev->mgmt_pending list during command cancellation and callback processing, and the race can also lead to a second list removal.

Affected software

How to mitigate CVE-2026-74510

External References

• https://git.kernel.org/stable/c/51be7280980fddc90ebe874a69c2fe8ab02bb46a
• https://git.kernel.org/stable/c/7c2a152a897cd1c184b2051484d4f74d803e7f4a
• https://git.kernel.org/stable/c/86ed4dd6548ccf277bc691bc912ca06e76b9d80c
• https://git.kernel.org/stable/c/c569def320aa8b1fde89227e2ea96606790fd86d
• https://git.kernel.org/stable/c/d0a7b48ad0921bd88effaee10bf970ab1d5d0ddd

Related Security Bulletins

• Use-after-free in Linux kernel bluetooth
• Debian update for linux