CVE-2026-74540 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Bluetooth L2CAP module developers, and organizations using Linux-based systems with Bluetooth capabilities should assess their exposure and apply patches or mitigations as needed.

Why it matters

The CVE-2026-74540 vulnerability in the Linux kernel's Bluetooth L2CAP module requires immediate attention from developers and administrators. A use-after-free vulnerability can be triggered by a remote disconnect, potentially leading to denial of service or code execution. Linux kernel developers, maintainers, and organizations using Linux-based systems with Bluetooth capabilities should assess their exposure and apply patches or mitigations as needed.

• Potential denial of service due to use-after-free vulnerability
• Possible code execution or privilege escalation
• Need for patching or mitigation to prevent exploitation
• Verification of Linux kernel versions and Bluetooth L2CAP module configurations required

Technical summary

The `l2cap_le_connect_rsp` function in the Linux kernel's Bluetooth L2CAP module does not properly handle channel references, leading to a use-after-free vulnerability. An attacker can trigger this vulnerability by initiating a remote disconnect, potentially causing a denial of service or code execution. The vulnerability exists due to a missing reference hold or use of `l2cap_chan_hold_unless_zero` before locking and operating on the channel. A concurrent `l2cap_chan_del` triggered by a remote disconnect can free the channel between the lookup and `l2cap_chan_lock`, causing a use-after-free. Linux kernel developers, maintainers, and organizations using Linux-based systems with Bluetooth capabilities should be

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor Bluetooth L2CAP activity for potential exploitation attempts
• Verify Linux kernel versions and Bluetooth L2CAP module configurations
• Assess exposure and apply patches or mitigations as needed
• Track exceptions and retest remediated assets
• Review compensating controls for exposed systems while remediation is scheduled

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description and affected versions. However, the corpus does not establish specific exploitation or impact details, requiring verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.