{"id":"CVE-2026-74509","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix advertising data UAFs\n\nhci_find_adv_instance() returns an adv_info pointer that is valid only\nwhile hdev->lock is held","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix advertising data UAFs\n\nhci_find_adv_instance() returns an adv_info pointer that is valid only\nwhile hdev->lock is held.  The advertising comman…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-825"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS (v. 10)","affected":["enterprise_linux 8","enterprise_linux 9","10base_smtv","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_hidden_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_10","enterprise_linux_real_time_v_9"],"patched":["10base_smtv","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_hidden_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_10","enterprise_linux_real_time_v_9"],"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:17:33.550","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74509","references":[{"url":"https://git.kernel.org/stable/c/565971488191bf54a87a417abafab6ad0de72201","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/95cdcd8c82a501931fd3ae9b3811b0b6da167e94","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b16ebdbebd2d37f4cdc590bc3e9db71fe90350a3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4cec575a6d6f7c36808a3a0017b0675968bb06b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cdc36db204ffd97b947d64374cf23a210dc74777","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb1d8318764de7216e6dbba29a24d69f7ce51348","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74509.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-74509"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2516967"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74509"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74509"},{"url":"https://lore.kernel.org/linux-cve-announce/2026081542-CVE-2026-74509-eb82@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:85321"},{"url":"https://access.redhat.com/errata/RHSA-2026:86033"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00249,"epssPercentile":0.16154,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:58:37.448836Z"},"scores":{"nvd":8.8,"vendor":8,"cna":8.8},"ingestedAt":"2026-10-16T19:46:24.352Z","slug":"CVE-2026-74509","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix advertising data UAFs\n\nhci_find_adv_instance() returns an adv_info pointer that is valid only\nwhile hdev->lock is held.  The advertising command-sync paths perform\ninstance lookups without that lock and, in some cases, retain the pointer\nwhile waiting for a controller response.\n\nAn advertising termination event can therefore interleave as follows:\n\n  hci_cmd_sync_work                 hci_rx_work\n  hci_find_adv_instance()\n  __hci_cmd_sync_status()\n    wait for controller reply       hci_dev_lock()\n                                    hci_remove_adv_instance()\n                                      kfree(adv)\n  adv->scan_rsp_changed = false\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in hci_set_ext_scan_rsp_data_sync+0x2e1/0x300\n  Write of size 1 at addr ffff88810a45d21d by task kworker/u17:0/88\n  Workqueue: hci0 hci_cmd_sync_work\n  Call Trace:\n   hci_set_ext_scan_rsp_data_sync+0x2e1/0x300\n   hci_schedule_adv_instance_sync+0x390/0x4c0\n   hci_cmd_sync_work+0x173/0x300\n  Allocated by task 87:\n   hci_add_adv_instance+0x538/0xac0\n   add_advertising+0x885/0x1160\n  Freed by task 89:\n   kfree+0x131/0x3c0\n   hci_remove_adv_instance+0x1d8/0x3b0\n   hci_le_ext_adv_term_evt+0x17b/0x730\n\nProtect the instance lookup and payload construction in the extended\nadvertising, scan response, and periodic advertising data paths.  Snapshot\nthe advertising parameters under hdev->lock, but release the lock before\nwaiting for the controller.\n\nClear advertising-data dirty bits before issuing their commands and\nrestore them after a failure using a fresh lookup.  Likewise, update the\nreported transmit power through a fresh lookup after the parameter command\ncompletes.  No adv_info pointer then survives an HCI command wait.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:85321** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85321)\n- **RHSA-2026:86033** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:86033)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74509.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":230403,"id":"CVE-2026-74509","ts":1793134636988,"field":"cvss","old":"8","new":"8.8"},{"seq":227175,"id":"CVE-2026-74509","ts":1792585188158,"field":"cvss","old":"8.8","new":"8"}]}