Withdrawn: this CVE is not a vulnerability
The assigning CNA withdrew CVE-2026-74511 on 19 August 2026, and it carries the Rejected state at CVE.org and NVD. It must not be treated as a live finding. Its pre-withdrawal severity, score and exploitability are withheld below; the record itself is kept because withdrawals are reversible and because the reject reason is the correction worth publishing.
WITHDRAWN
CVE-2026-74511
Bluetooth: mgmt: fix pending command UAF in EIR updates
Overview
Description
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Details
INFO
Published Date :
Aug. 15, 2026, 1:17 p.m.
Last Modified :
Aug. 19, 2026, 1:18 p.m.
Remotely Exploit :
—
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-74511 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-74511 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Rejected by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 19, 2026
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 19, 2026
Action Type Old Value New Value Changed Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix pending command UAF in EIR updates MGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers and can run set_name_sync(). When the controller is BR/EDR capable, set_name_sync() updates the local name and then rebuilds EIR data through eir_create(). The EIR builder walks hdev->uuids, but the UUID list can be changed and entries can be freed by MGMT_OP_ADD_UUID and MGMT_OP_REMOVE_UUID. pending_eir_or_class() is meant to serialize management commands that can change EIR or the class of device, but it did not include MGMT_OP_SET_LOCAL_NAME. In addition, it walked hdev->mgmt_pending without hdev->mgmt_pending_lock even though pending commands are added and removed under that mutex. A racing command completion can therefore remove and free a pending command while pending_eir_or_class() is still inspecting it, leading to a use-after-free in the pending-command list or allowing a local name update to rebuild EIR while UUID entries are being removed. Take hdev->mgmt_pending_lock while scanning hdev->mgmt_pending and treat MGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting pending command on the powered asynchronous path. Check for a conflicting pending command before copying the new short name so a rejected SET_LOCAL_NAME request does not modify hdev->short_name. Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Removed CVSS V3.1 kernel.org: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Removed Reference kernel.org: https://git.kernel.org/stable/c/35464ff818165131464bd524c259db1ac8044ae3 Removed Reference kernel.org: https://git.kernel.org/stable/c/814f82f432dc6ee4d15f94756554ff94e6e3ef05 Removed Reference kernel.org: https://git.kernel.org/stable/c/8f2f62855a41d1730fb9e8122912bd2c8d6bed5d Removed Reference kernel.org: https://git.kernel.org/stable/c/a9e7c2609b0cb3fb4b4ba9f66dd8727d33205967 Removed Reference kernel.org: https://git.kernel.org/stable/c/eacfcb6b735d0e16b4d2ecfde4b9141225ee934e Removed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'bdd56875c6926d8009914f427df71797693e90d4', 'lessThan': 'a9e7c2609b0cb3fb4b4ba9f66dd8727d33205967', 'versionType': 'git'}, {'status': 'affected', 'version': '4e83f2dbb2bf677e614109df24426c4dded472d4', 'lessThan': 'eacfcb6b735d0e16b4d2ecfde4b9141225ee934e', 'versionType': 'git'}, {'status': 'affected', 'version': '6fe26f694c824b8a4dbf50c635bee1302e3f099c', 'lessThan': '814f82f432dc6ee4d15f94756554ff94e6e3ef05', 'versionType': 'git'}, {'status': 'affected', 'version': '6fe26f694c824b8a4dbf50c635bee1302e3f099c', 'lessThan': '35464ff818165131464bd524c259db1ac8044ae3', 'versionType': 'git'}, {'status': 'affected', 'version': '6fe26f694c824b8a4dbf50c635bee1302e3f099c', 'lessThan': '8f2f62855a41d1730fb9e8122912bd2c8d6bed5d', 'versionType': 'git'}, {'status': 'affected', 'version': 'd7882db79135c829a922daf3571f33ea1e056ae3', 'versionType': 'git'}, {'status': 'affected', 'version': '6.6.94', 'lessThan': '6.6.151', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.12.34', 'lessThan': '6.12.103', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.15.3', 'lessThan': '6.16', 'versionType': 'semver'}], 'programFiles': ['net/bluetooth/mgmt.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.151', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.103', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/bluetooth/mgmt.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'bdd56875c6926d8009914f427df71797693e90d4', 'lessThan': 'a9e7c2609b0cb3fb4b4ba9f66dd8727d33205967', 'versionType': 'git'}, {'status': 'affected', 'version': '4e83f2dbb2bf677e614109df24426c4dded472d4', 'lessThan': 'eacfcb6b735d0e16b4d2ecfde4b9141225ee934e', 'versionType': 'git'}, {'status': 'affected', 'version': '6fe26f694c824b8a4dbf50c635bee1302e3f099c', 'lessThan': '814f82f432dc6ee4d15f94756554ff94e6e3ef05', 'versionType': 'git'}, {'status': 'affected', 'version': '6fe26f694c824b8a4dbf50c635bee1302e3f099c', 'lessThan': '35464ff818165131464bd524c259db1ac8044ae3', 'versionType': 'git'}, {'status': 'affected', 'version': '6fe26f694c824b8a4dbf50c635bee1302e3f099c', 'lessThan': '8f2f62855a41d1730fb9e8122912bd2c8d6bed5d', 'versionType': 'git'}, {'status': 'affected', 'version': 'd7882db79135c829a922daf3571f33ea1e056ae3', 'versionType': 'git'}, {'status': 'affected', 'version': '6.6.94', 'lessThan': '6.6.151', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.12.34', 'lessThan': '6.12.103', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.15.3', 'lessThan': '6.16', 'versionType': 'semver'}], 'programFiles': ['net/bluetooth/mgmt.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.151', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.103', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc6', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/bluetooth/mgmt.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'bdd56875c6926d8009914f427df71797693e90d4', 'lessThan': 'a9e7c2609b0cb3fb4b4ba9f66dd8727d33205967', 'versionType': 'git'}, {'status': 'affected', 'version': '4e83f2dbb2bf677e614109df24426c4dded472d4', 'lessThan': 'eacfcb6b735d0e16b4d2ecfde4b9141225ee934e', 'versionType': 'git'}, {'status': 'affected', 'version': '6fe26f694c824b8a4dbf50c635bee1302e3f099c', 'lessThan': '814f82f432dc6ee4d15f94756554ff94e6e3ef05', 'versionType': 'git'}, {'status': 'affected', 'version': '6fe26f694c824b8a4dbf50c635bee1302e3f099c', 'lessThan': '35464ff818165131464bd524c259db1ac8044ae3', 'versionType': 'git'}, {'status': 'affected', 'version': '6fe26f694c824b8a4dbf50c635bee1302e3f099c', 'lessThan': '8f2f62855a41d1730fb9e8122912bd2c8d6bed5d', 'versionType': 'git'}, {'status': 'affected', 'version': 'd7882db79135c829a922daf3571f33ea1e056ae3', 'versionType': 'git'}, {'status': 'affected', 'version': '6.6.94', 'lessThan': '6.6.151', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.12.34', 'lessThan': '6.12.103', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.15.3', 'lessThan': '6.16', 'versionType': 'semver'}], 'programFiles': ['net/bluetooth/mgmt.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.151', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.103', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/bluetooth/mgmt.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'bdd56875c6926d8009914f427df71797693e90d4', 'lessThan': 'a9e7c2609b0cb3fb4b4ba9f66dd8727d33205967', 'versionType': 'git'}, {'status': 'affected', 'version': '4e83f2dbb2bf677e614109df24426c4dded472d4', 'lessThan': 'eacfcb6b735d0e16b4d2ecfde4b9141225ee934e', 'versionType': 'git'}, {'status': 'affected', 'version': '6fe26f694c824b8a4dbf50c635bee1302e3f099c', 'lessThan': '814f82f432dc6ee4d15f94756554ff94e6e3ef05', 'versionType': 'git'}, {'status': 'affected', 'version': '6fe26f694c824b8a4dbf50c635bee1302e3f099c', 'lessThan': '35464ff818165131464bd524c259db1ac8044ae3', 'versionType': 'git'}, {'status': 'affected', 'version': '6fe26f694c824b8a4dbf50c635bee1302e3f099c', 'lessThan': '8f2f62855a41d1730fb9e8122912bd2c8d6bed5d', 'versionType': 'git'}, {'status': 'affected', 'version': 'd7882db79135c829a922daf3571f33ea1e056ae3', 'versionType': 'git'}, {'status': 'affected', 'version': '6.6.94', 'lessThan': '6.6.151', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.12.34', 'lessThan': '6.12.103', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.15.3', 'lessThan': '6.16', 'versionType': 'semver'}], 'programFiles': ['net/bluetooth/mgmt.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.151', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.103', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc6', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/bluetooth/mgmt.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix pending command UAF in EIR updates MGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers and can run set_name_sync(). When the controller is BR/EDR capable, set_name_sync() updates the local name and then rebuilds EIR data through eir_create(). The EIR builder walks hdev->uuids, but the UUID list can be changed and entries can be freed by MGMT_OP_ADD_UUID and MGMT_OP_REMOVE_UUID. pending_eir_or_class() is meant to serialize management commands that can change EIR or the class of device, but it did not include MGMT_OP_SET_LOCAL_NAME. In addition, it walked hdev->mgmt_pending without hdev->mgmt_pending_lock even though pending commands are added and removed under that mutex. A racing command completion can therefore remove and free a pending command while pending_eir_or_class() is still inspecting it, leading to a use-after-free in the pending-command list or allowing a local name update to rebuild EIR while UUID entries are being removed. Take hdev->mgmt_pending_lock while scanning hdev->mgmt_pending and treat MGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting pending command on the powered asynchronous path. Check for a conflicting pending command before copying the new short name so a rejected SET_LOCAL_NAME request does not modify hdev->short_name. Added Reference https://git.kernel.org/stable/c/35464ff818165131464bd524c259db1ac8044ae3 Added Reference https://git.kernel.org/stable/c/814f82f432dc6ee4d15f94756554ff94e6e3ef05 Added Reference https://git.kernel.org/stable/c/8f2f62855a41d1730fb9e8122912bd2c8d6bed5d Added Reference https://git.kernel.org/stable/c/a9e7c2609b0cb3fb4b4ba9f66dd8727d33205967 Added Reference https://git.kernel.org/stable/c/eacfcb6b735d0e16b4d2ecfde4b9141225ee934e
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.