UBUNTU-CVE-2026-74529: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectpasync() callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Hold a reference count on the Bluetooth connection in the hci_connect_pa_sync() callback while the hci_sync task is running to prevent a use-after-free.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running one of the listed Ubuntu kernel package families are in scope. Exploitation is local and involves the Bluetooth HCI periodic advertising synchronization connection path.
What does an attacker need to exploit it?
The supplied vector indicates an attacker needs local access, low privileges, no user interaction, and high attack complexity. The vulnerable condition is a theoretical use-after-free when a connection is freed while an HCI synchronization task is still running.
What is the potential impact if exploitation succeeds?
The provided severity vector rates confidentiality, integrity, and availability impacts as high, with no impact on a separate security authority. The reported severity is high with a score of 7.3.