« Volver al listado

CVE-2026-74540

Estado: RecibidaAlta (8.8)—

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp

l2cap_le_connect_rsp() obtains a channel via __l2cap_get_chan_by_ident() but neither holds a reference nor uses l2cap_chan_hold_unless_zero() before locking and operating on it. A concurrent l2cap_chan_del() triggered by a remote disconnect can free the channel between the lookup and l2cap_chan_lock(), causing a use-after-free.

The BR/EDR counterpart l2cap_connect_rsp() and the sibling handler l2cap_le_command_rej() already use l2cap_chan_hold_unless_zero() to safely hold a reference, but l2cap_le_connect_rsp() was left unprotected.

Leer descripción completaMostrar menos

Fix by adding l2cap_chan_hold_unless_zero() after the ident lookup and l2cap_chan_put() on the exit path, consistent with other L2CAP response handlers.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de use-after-free en L2CAP (Bluetooth) que requiere acceso de red adyacente (AV:A) sin privilegios. Permite escalada de privilegios o denegación de servicio mediante la explotación de la condición de carrera en el kernel.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability ScanningPrivileged Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-74540",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
              "lessThan": "15d6c2367217a6a20b1abae9f38ded716bf620f1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
              "lessThan": "1818180fe12d6cec7a437bc59cde8efdf6b10250",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
              "lessThan": "8325eafb38c3dee5af329266393763693d17381b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
              "lessThan": "fd4c1e301bdec60a40728ea37de531cbccda501a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
              "lessThan": "522b730c62c53a1981604fd73524697fd347830d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
              "lessThan": "58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
              "lessThan": "09f447accc2570751e7d17f0dc0788b40d3edade",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
              "lessThan": "c4740e7f23ff9a8210198d8b4703259e21b9f69d",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.14",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T13:17:59.337",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/09f447accc2570751e7d17f0dc0788b40d3edade",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/15d6c2367217a6a20b1abae9f38ded716bf620f1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1818180fe12d6cec7a437bc59cde8efdf6b10250",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/522b730c62c53a1981604fd73524697fd347830d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8325eafb38c3dee5af329266393763693d17381b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c4740e7f23ff9a8210198d8b4703259e21b9f69d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fd4c1e301bdec60a40728ea37de531cbccda501a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp\n\nl2cap_le_connect_rsp() obtains a channel via\n__l2cap_get_chan_by_ident() but neither holds a reference nor uses\nl2cap_chan_hold_unless_zero() before locking and operating on it.\nA concurrent l2cap_chan_del() triggered by a remote disconnect can\nfree the channel between the lookup and l2cap_chan_lock(), causing\na use-after-free.\n\nThe BR/EDR counterpart l2cap_connect_rsp() and the sibling handler\nl2cap_le_command_rej() already use l2cap_chan_hold_unless_zero()\nto safely hold a reference, but l2cap_le_connect_rsp() was left\nunprotected.\n\nFix by adding l2cap_chan_hold_unless_zero() after the ident lookup\nand l2cap_chan_put() on the exit path, consistent with other L2CAP\nresponse handlers."
    }
  ],
  "lastModified": "2026-08-19T17:21:09.300",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}