GHSA-65qm-758v-r47wHighCVSS 8.8
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold...
🔗 CVE IDs covered (1)
📋 Description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
There is theoretical UAF if the conn is freed while the hci_sync task is running.
Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the previous behavior.
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2026-74530
- https://git.kernel.org/stable/c/2d91e6244b69d752503b2d44020d8b0e323dbd38
- https://git.kernel.org/stable/c/56e78b670356caab0b607e8aad4cf819a1909d07
- https://git.kernel.org/stable/c/ff5625d27415ace5667bf87ebc16c3a0a98db22f
- https://github.com/advisories/GHSA-65qm-758v-r47w