CVE-2026-74511
Bluetooth: mgmt: fix pending command UAF in EIR updates
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix pending command UAF in EIR updates MGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers and can run set_name_sync(). When the controller is BR/EDR capable, set_name_sync() updates the local name and then rebuilds EIR data through eir_create(). The EIR builder walks hdev->uuids, but the UUID list can be changed and entries can be freed by MGMT_OP_ADD_UUID and MGMT_OP_REMOVE_UUID. pending_eir_or_class() is meant to serialize management commands that can change EIR or the class of device, but it did not include MGMT_OP_SET_LOCAL_NAME. In addition, it walked hdev->mgmt_pending without hdev->mgmt_pending_lock even though pending commands are added and removed under that mutex. A racing command completion can therefore remove and free a pending command while pending_eir_or_class() is still inspecting it, leading to a use-after-free in the pending-command list or allowing a local name update to rebuild EIR while UUID entries are being removed. Take hdev->mgmt_pending_lock while scanning hdev->mgmt_pending and treat MGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting pending command on the powered asynchronous path. Check for a conflicting pending command before copying the new short name so a rejected SET_LOCAL_NAME request does not modify hdev->short_name.
INFO
Published Date :
Aug. 15, 2026, 1:17 p.m.
Last Modified :
Aug. 15, 2026, 1:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-74511
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Update the Linux kernel to the latest version.
- Ensure Bluetooth drivers are up-to-date.
- Review kernel patch notes for security fixes.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-74511.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-74511 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-74511
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-74511 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-74511 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'bdd56875c6926d8009914f427df71797693e90d4', 'lessThan': 'a9e7c2609b0cb3fb4b4ba9f66dd8727d33205967', 'versionType': 'git'}, {'status': 'affected', 'version': '4e83f2dbb2bf677e614109df24426c4dded472d4', 'lessThan': 'eacfcb6b735d0e16b4d2ecfde4b9141225ee934e', 'versionType': 'git'}, {'status': 'affected', 'version': '6fe26f694c824b8a4dbf50c635bee1302e3f099c', 'lessThan': '814f82f432dc6ee4d15f94756554ff94e6e3ef05', 'versionType': 'git'}, {'status': 'affected', 'version': '6fe26f694c824b8a4dbf50c635bee1302e3f099c', 'lessThan': '35464ff818165131464bd524c259db1ac8044ae3', 'versionType': 'git'}, {'status': 'affected', 'version': '6fe26f694c824b8a4dbf50c635bee1302e3f099c', 'lessThan': '8f2f62855a41d1730fb9e8122912bd2c8d6bed5d', 'versionType': 'git'}, {'status': 'affected', 'version': 'd7882db79135c829a922daf3571f33ea1e056ae3', 'versionType': 'git'}, {'status': 'affected', 'version': '6.6.94', 'lessThan': '6.6.151', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.12.34', 'lessThan': '6.12.103', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.15.3', 'lessThan': '6.16', 'versionType': 'semver'}], 'programFiles': ['net/bluetooth/mgmt.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.151', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.103', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc6', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/bluetooth/mgmt.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix pending command UAF in EIR updates MGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers and can run set_name_sync(). When the controller is BR/EDR capable, set_name_sync() updates the local name and then rebuilds EIR data through eir_create(). The EIR builder walks hdev->uuids, but the UUID list can be changed and entries can be freed by MGMT_OP_ADD_UUID and MGMT_OP_REMOVE_UUID. pending_eir_or_class() is meant to serialize management commands that can change EIR or the class of device, but it did not include MGMT_OP_SET_LOCAL_NAME. In addition, it walked hdev->mgmt_pending without hdev->mgmt_pending_lock even though pending commands are added and removed under that mutex. A racing command completion can therefore remove and free a pending command while pending_eir_or_class() is still inspecting it, leading to a use-after-free in the pending-command list or allowing a local name update to rebuild EIR while UUID entries are being removed. Take hdev->mgmt_pending_lock while scanning hdev->mgmt_pending and treat MGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting pending command on the powered asynchronous path. Check for a conflicting pending command before copying the new short name so a rejected SET_LOCAL_NAME request does not modify hdev->short_name. Added Reference https://git.kernel.org/stable/c/35464ff818165131464bd524c259db1ac8044ae3 Added Reference https://git.kernel.org/stable/c/814f82f432dc6ee4d15f94756554ff94e6e3ef05 Added Reference https://git.kernel.org/stable/c/8f2f62855a41d1730fb9e8122912bd2c8d6bed5d Added Reference https://git.kernel.org/stable/c/a9e7c2609b0cb3fb4b4ba9f66dd8727d33205967 Added Reference https://git.kernel.org/stable/c/eacfcb6b735d0e16b4d2ecfde4b9141225ee934e