CVE-2026-74511

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Bluetooth management component during Extended Inquiry Response (EIR) updates. The MGMT OP SET LOCAL NAME command is handled asynchronously and can trigger set name sync(), which rebuilds EIR data via eir create(). Because the pending eir or class() function failed to include MGMT OP SET LOCAL NAME and accessed hdev->mgmt pending without the hdev->mgmt pending lock mutex, a race condition occurs. A concurrent command completion can free a pending command while it is still being inspected, or allow EIR rebuilding while UUID entries are being removed by MGMT OP ADD UUID or MGMT OP REMOVE UUID.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.