CVE-2026-74509 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should review and apply patches as soon as possible. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and its potential impact on their systems. Operators of Linux-based systems should also be aware of this vulnerability and take steps to mitigate it. This includes reviewing and applying patches, monitoring Linux kernel updates, and implementing compensating controls to mitigate potential attacks. Security teams should also review their asset inventory and implement monitoring and detection controls to identify potential attacks. Rollback/change windows and source tracking should also be considered to mitigate this vulnerability. Compensating controls, such as implementing firewalls or intrusion detection systems, may also be necessary to mitigate potential attacks. Overall, a coordinated effort between Linux kernel developers, maintainers, and users of Linux-based systems is necessary to mitigate this vulnerability. This may involve reviewing and applying patches, implementing compensating controls, and monitoring Linux kernel updates. By taking these steps, the risk of exploitation can be reduced. Linux kernel developers and maintainers should prioritize patching and disclosure. Linux distribution vendors and users of Linux-based systems should also prioritize patching and take steps to mitigate potential attacks. Security teams and vulnerability management teams should review their asset inventory and implement monitoring and detection controls to identify potential attacks. Compensating controls, such as firewalls or intrusion detection systems, may also be necessary to mitigate potential attacks. Overall, a coordinated effort between Linux kernel developers, maintainers, and users of Linux-based systems is necessary to mitigate this vulnerability. This may involve reviewing and applying patches, implementing compensating controls, and monitoring Linux kernel updates. By taking these steps, the risk of exploitation can be reduced. Linux kernel developers and maintainers should prioritize patching and work,

Technical summary

The vulnerability is caused by a use-after-free error in the Bluetooth hci_sync module. An advertising termination event can interleave with the advertising command-sync paths, leading to a use-after-free error. The issue is resolved by protecting the instance lookup and payload construction in the extended advertising, scan response, and periodic advertising data paths. This vulnerability affects the Linux kernel and has a high CVSS score of 8.8. To mitigate this vulnerability, it is recommended to review and apply patches for the Linux kernel as soon as possible.

Defensive priority

This vulnerability has a high CVSS score of 8.8 and is related to the Linux kernel. It is recommended to review and apply patches as soon as possible.

Recommended defensive actions

• Review and apply patches for the Linux kernel as soon as possible
• Monitor Linux kernel updates and apply patches promptly
• Consider implementing compensating controls to mitigate potential attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by a use-after-free error in the Bluetooth hci_sync module. An advertising termination event can interleave with the advertising command-sync paths, leading to a use-after-free error. The issue is resolved by protecting the instance lookup and payload construction in the extended advertising, scan response, and periodic advertising data paths.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.