CVE-2026-74509

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Fix advertising data UAFs

hci_find_adv_instance() returns an adv_info pointer that is valid only

while hdev->lock is held. The advertising command-sync paths perform

instance lookups without that lock and, in some cases, retain the pointer

while waiting for a controller response.

An advertising termination event can therefore interleave as follows:

hci_cmd_sync_work hci_rx_work

hci_find_adv_instance()

__hci_cmd_sync_status()

wait for controller reply hci_dev_lock()

hci_remove_adv_instance()

kfree(adv)

adv->scan_rsp_changed = false

KASAN reported:

BUG: KASAN: slab-use-after-free in hci_set_ext_scan_rsp_data_sync+0x2e1/0x300

Write of size 1 at addr ffff88810a45d21d by task kworker/u17:0/88

Workqueue: hci0 hci_cmd_sync_work

Call Trace:

hci_set_ext_scan_rsp_data_sync+0x2e1/0x300

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References