CVE-2026-74510

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: fix UAF in pair command cancellation

The pairing completion and authentication failure callbacks look up the

pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending. The

lookup returned a command that was still linked on the shared pending list,

without keeping mgmt_pending_lock held for the later dereference and

removal.

A concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the

same pending command before the callback uses it. The reverse race is also

possible when cancel_pair_device() gets a command from pending_find() and a

callback removes it before the cancel path dereferences it. This can lead

to a use-after-free and a second list_del().

Make the pairing lookup helpers transfer ownership of the pending command

by removing it from hdev->mgmt_pending while holding mgmt_pending_lock.

The callbacks and cancel path then complete the command and free it

directly, so racing p

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References