Answer in brief
CVE-2026-74511 records a Unknown severity vulnerability in Bluetooth: mgmt: fix pending command UAF in EIR updates. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=bdd56875c6926d8009914f427df71797693e90d4 <a9e7c2609b0cb3fb4b4ba9f66dd8727d33205967 || >=4e83f2dbb2bf677e614109df24426c4dded472d4 <eacfcb6b735d0e16b4d2ecfde4b9141225ee934e || >=6fe26f694c824b8a4dbf50c635bee1302e3f099c <814f82f432dc6ee4d15f94756554ff94e6e3ef05 || >=6fe26f694c824b8a4dbf50c635bee1302e3f099c <35464ff818165131464bd524c259db1ac8044ae3 || >=6fe26f694c824b8a4dbf50c635bee1302e3f099c <8f2f62855a41d1730fb9e8122912bd2c8d6bed5d || d7882db79135c829a922daf3571f33ea1e056ae3 || >=6.6.94 <6.6.151 || >=6.12.34 <6.12.103 || >=6.15.3 <6.16 | a9e7c2609b0cb3fb4b4ba9f66dd8727d33205967, eacfcb6b735d0e16b4d2ecfde4b9141225ee934e, 814f82f432dc6ee4d15f94756554ff94e6e3ef05, 35464ff818165131464bd524c259db1ac8044ae3, 8f2f62855a41d1730fb9e8122912bd2c8d6bed5d, 6.6.151, 6.12.103, 6.16 |
| Linux/Linuxgeneric | 6.16 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix pending command UAF in EIR updates MGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers and can run set_name_sync(). When the controller is BR/EDR capable, set_name_sync() updates the local name and then rebuilds EIR data through eir_create(). The EIR builder walks hdev->uuids, but the UUID list can be changed and entries can be freed by MGMT_OP_ADD_UUID and MGMT_OP_REMOVE_UUID. pending_eir_or_class() is meant to serialize management commands that can change EIR or the class of device, but it did not include MGMT_OP_SET_LOCAL_NAME. In addition, it walked hdev->mgmt_pending without hdev->mgmt_pending_lock even though pending commands are added and removed under that mutex. A racing command completion can therefore remove and free a pending command while pending_eir_or_class() is still inspecting it, leading to a use-after-free in the pending-command list or allowing a local name update to rebuild EIR while UUID entries are being removed. Take hdev->mgmt_pending_lock while scanning hdev->mgmt_pending and treat MGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting pending command on the powered asynchronous path. Check for a conflicting pending command before copying the new short name so a rejected SET_LOCAL_NAME request does not modify hdev->short_name.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-74511 records a Unknown severity vulnerability in Bluetooth: mgmt: fix pending command UAF in EIR updates. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=bdd56875c6926d8009914f427df71797693e90d4 <a9e7c2609b0cb3fb4b4ba9f66dd8727d33205967 || >=4e83f2dbb2bf677e614109df24426c4dded472d4 <eacfcb6b735d0e16b4d2ecfde4b9141225ee934e || >=6fe26f694c824b8a4dbf50c635bee1302e3f099c <814f82f432dc6ee4d15f94756554ff94e6e3ef05 || >=6fe26f694c824b8a4dbf50c635bee1302e3f099c <35464ff818165131464bd524c259db1ac8044ae3 || >=6fe26f694c824b8a4dbf50c635bee1302e3f099c <8f2f62855a41d1730fb9e8122912bd2c8d6bed5d || d7882db79135c829a922daf3571f33ea1e056ae3 || >=6.6.94 <6.6.151 || >=6.12.34 <6.12.103 || >=6.15.3 <6.16 | a9e7c2609b0cb3fb4b4ba9f66dd8727d33205967, eacfcb6b735d0e16b4d2ecfde4b9141225ee934e, 814f82f432dc6ee4d15f94756554ff94e6e3ef05, 35464ff818165131464bd524c259db1ac8044ae3, 8f2f62855a41d1730fb9e8122912bd2c8d6bed5d, 6.6.151, 6.12.103, 6.16 |
| Linux/Linuxgeneric | 6.16 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix pending command UAF in EIR updates MGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers and can run set_name_sync(). When the controller is BR/EDR capable, set_name_sync() updates the local name and then rebuilds EIR data through eir_create(). The EIR builder walks hdev->uuids, but the UUID list can be changed and entries can be freed by MGMT_OP_ADD_UUID and MGMT_OP_REMOVE_UUID. pending_eir_or_class() is meant to serialize management commands that can change EIR or the class of device, but it did not include MGMT_OP_SET_LOCAL_NAME. In addition, it walked hdev->mgmt_pending without hdev->mgmt_pending_lock even though pending commands are added and removed under that mutex. A racing command completion can therefore remove and free a pending command while pending_eir_or_class() is still inspecting it, leading to a use-after-free in the pending-command list or allowing a local name update to rebuild EIR while UUID entries are being removed. Take hdev->mgmt_pending_lock while scanning hdev->mgmt_pending and treat MGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting pending command on the powered asynchronous path. Check for a conflicting pending command before copying the new short name so a rejected SET_LOCAL_NAME request does not modify hdev->short_name.
Quoted source text, attributed separately from HOL analysis.