In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback

There is theoretical UAF if the conn is freed while the hci_sync task is
running.

Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to
match the previous behavior.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
024421cf39923927ab2b5fe895d1d922b9abe67f affected < 2d91e6244b69d752503b2d44020d8b0e323dbd38
024421cf39923927ab2b5fe895d1d922b9abe67f affected < 56e78b670356caab0b607e8aad4cf819a1909d07
620810ac1f7f1133a9ac403e132b3ad6995ddf39 affected —
ee0586ad64a805eaf1a9a10100e908627a561e34 affected —
6.12.28 affected < 6.13
6.14.6 affected < 6.15
Linux Linux affected
Version Status Constraints
6.15 affected —
0 unaffected < 6.15
7.1.8 unaffected ≤ 7.1.*
7.2-rc6 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/2d91e6244b69d752503b2d44020d8b0e323dbd38 cve-icon cve-icon
https://git.kernel.org/stable/c/56e78b670356caab0b607e8aad4cf819a1909d07 cve-icon cve-icon
History

Sat, 15 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
CWE-476

Sat, 15 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the previous behavior.
Title Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T12:27:45.381Z

Reserved: 2026-08-15T05:44:03.912Z

Link: CVE-2026-74530

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T13:17:58.297

Modified: 2026-08-15T13:17:58.297

Link: CVE-2026-74530

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T14:45:03Z

Weaknesses