CVE-2026-74509

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free (UAF) issue exists in the Bluetooth subsystem. The function hci find adv instance() returns an adv info pointer that is only valid while hdev->lock is held. However, advertising command-sync paths perform instance lookups without this lock and may retain the pointer while waiting for a controller response. If an advertising termination event occurs during this wait, the hci remove adv instance() function may free the memory, leading to a slab-use-after-free when the system later attempts to access the pointer, such as in the hci set ext scan rsp data sync() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.