CVE-2026-74509 (GCVE-0-2026-74509)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-27 12:39
VLAI
Title
Bluetooth: hci_sync: Fix advertising data UAFs
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix advertising data UAFs hci_find_adv_instance() returns an adv_info pointer that is valid only while hdev->lock is held. The advertising command-sync paths perform instance lookups without that lock and, in some cases, retain the pointer while waiting for a controller response. An advertising termination event can therefore interleave as follows: hci_cmd_sync_work hci_rx_work hci_find_adv_instance() __hci_cmd_sync_status() wait for controller reply hci_dev_lock() hci_remove_adv_instance() kfree(adv) adv->scan_rsp_changed = false KASAN reported: BUG: KASAN: slab-use-after-free in hci_set_ext_scan_rsp_data_sync+0x2e1/0x300 Write of size 1 at addr ffff88810a45d21d by task kworker/u17:0/88 Workqueue: hci0 hci_cmd_sync_work Call Trace: hci_set_ext_scan_rsp_data_sync+0x2e1/0x300 hci_schedule_adv_instance_sync+0x390/0x4c0 hci_cmd_sync_work+0x173/0x300 Allocated by task 87: hci_add_adv_instance+0x538/0xac0 add_advertising+0x885/0x1160 Freed by task 89: kfree+0x131/0x3c0 hci_remove_adv_instance+0x1d8/0x3b0 hci_le_ext_adv_term_evt+0x17b/0x730 Protect the instance lookup and payload construction in the extended advertising, scan response, and periodic advertising data paths. Snapshot the advertising parameters under hdev->lock, but release the lock before waiting for the controller. Clear advertising-data dirty bits before issuing their commands and restore them after a failure using a fresh lookup. Likewise, update the reported transmit power through a fresh lookup after the parameter command completes. No adv_info pointer then survives an HCI command wait.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cba6b758711cab946c787f7c15be92cc749b8e1f , < 565971488191bf54a87a417abafab6ad0de72201 (git)
Affected: cba6b758711cab946c787f7c15be92cc749b8e1f , < c4cec575a6d6f7c36808a3a0017b0675968bb06b (git)
Affected: cba6b758711cab946c787f7c15be92cc749b8e1f , < 95cdcd8c82a501931fd3ae9b3811b0b6da167e94 (git)
Affected: cba6b758711cab946c787f7c15be92cc749b8e1f , < eb1d8318764de7216e6dbba29a24d69f7ce51348 (git)
Affected: cba6b758711cab946c787f7c15be92cc749b8e1f , < b16ebdbebd2d37f4cdc590bc3e9db71fe90350a3 (git)
Affected: cba6b758711cab946c787f7c15be92cc749b8e1f , < cdc36db204ffd97b947d64374cf23a210dc74777 (git)
Affected: 42fe380baaaccbe635c34ca07b29d19b9ec2498d (git)
Affected: 5.15.210 , < 5.16 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.154 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "565971488191bf54a87a417abafab6ad0de72201",
              "status": "affected",
              "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
              "versionType": "git"
            },
            {
              "lessThan": "c4cec575a6d6f7c36808a3a0017b0675968bb06b",
              "status": "affected",
              "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
              "versionType": "git"
            },
            {
              "lessThan": "95cdcd8c82a501931fd3ae9b3811b0b6da167e94",
              "status": "affected",
              "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
              "versionType": "git"
            },
            {
              "lessThan": "eb1d8318764de7216e6dbba29a24d69f7ce51348",
              "status": "affected",
              "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
              "versionType": "git"
            },
            {
              "lessThan": "b16ebdbebd2d37f4cdc590bc3e9db71fe90350a3",
              "status": "affected",
              "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
              "versionType": "git"
            },
            {
              "lessThan": "cdc36db204ffd97b947d64374cf23a210dc74777",
              "status": "affected",
              "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "42fe380baaaccbe635c34ca07b29d19b9ec2498d",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.210",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.154",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.210",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix advertising data UAFs\n\nhci_find_adv_instance() returns an adv_info pointer that is valid only\nwhile hdev-\u003elock is held.  The advertising command-sync paths perform\ninstance lookups without that lock and, in some cases, retain the pointer\nwhile waiting for a controller response.\n\nAn advertising termination event can therefore interleave as follows:\n\n  hci_cmd_sync_work                 hci_rx_work\n  hci_find_adv_instance()\n  __hci_cmd_sync_status()\n    wait for controller reply       hci_dev_lock()\n                                    hci_remove_adv_instance()\n                                      kfree(adv)\n  adv-\u003escan_rsp_changed = false\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in hci_set_ext_scan_rsp_data_sync+0x2e1/0x300\n  Write of size 1 at addr ffff88810a45d21d by task kworker/u17:0/88\n  Workqueue: hci0 hci_cmd_sync_work\n  Call Trace:\n   hci_set_ext_scan_rsp_data_sync+0x2e1/0x300\n   hci_schedule_adv_instance_sync+0x390/0x4c0\n   hci_cmd_sync_work+0x173/0x300\n  Allocated by task 87:\n   hci_add_adv_instance+0x538/0xac0\n   add_advertising+0x885/0x1160\n  Freed by task 89:\n   kfree+0x131/0x3c0\n   hci_remove_adv_instance+0x1d8/0x3b0\n   hci_le_ext_adv_term_evt+0x17b/0x730\n\nProtect the instance lookup and payload construction in the extended\nadvertising, scan response, and periodic advertising data paths.  Snapshot\nthe advertising parameters under hdev-\u003elock, but release the lock before\nwaiting for the controller.\n\nClear advertising-data dirty bits before issuing their commands and\nrestore them after a failure using a fresh lookup.  Likewise, update the\nreported transmit power through a fresh lookup after the parameter command\ncompletes.  No adv_info pointer then survives an HCI command wait."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in the Bluetooth HCI LE extended-advertising path; a remote/adjacent peer can deliver the LE Extended Advertising Set Terminated HCI event that frees adv_info while hci_cmd_sync_work waits on the controller during scan-response/advertising-data updates on phones and other BLE devices.\nAC:L - This is a use-after-free race between hci_cmd_sync_work and hci_rx_work where the attacker controls the terminating side by repeatedly initiating BLE connections/terminations during the up-to-2s HCI command wait, and can also drive the setup side via MGMT advertising commands.\nPR:N - An adjacent Bluetooth attacker needs no account, credentials, or capabilities on the victim; exploitation only requires the victim stack to be configuring BLE advertising (normal on Android phones, laptops, and IoT) while the attacker sends over-the-air BLE traffic to trigger hci_le_ext_adv_term_evt.\nUI:N - No deliberate victim action is required beyond a device running Bluetooth with LE advertising updates (common default behavior); the attacker triggers the race remotely without social engineering, file opens, or mounts.\nS:U - Impact is kernel heap corruption and potential local privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary.\nC:H - Multiple UAF paths read freed adv_info (e.g., eir_create_scan_rsp/adv_data) and retain dangling pointers across __hci_cmd_sync_status waits, enabling slab reuse and arbitrary kernel memory disclosure via heap grooming.\nI:H - KASAN shows a post-free write to adv_info (scan_rsp_changed); similar paths write adv_data_changed and tx_power on freed objects, providing exploitable heap corruption for arbitrary kernel writes and code execution.\nA:H - Use-after-free on adv_info in hci_cmd_sync_work can cause immediate kernel oops/panic or hung BLE subsystem during advertising reconfiguration, and is reachable from unauthenticated adjacent BLE interaction on actively advertising devices."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:39:46.394Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/565971488191bf54a87a417abafab6ad0de72201"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4cec575a6d6f7c36808a3a0017b0675968bb06b"
        },
        {
          "url": "https://git.kernel.org/stable/c/95cdcd8c82a501931fd3ae9b3811b0b6da167e94"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb1d8318764de7216e6dbba29a24d69f7ce51348"
        },
        {
          "url": "https://git.kernel.org/stable/c/b16ebdbebd2d37f4cdc590bc3e9db71fe90350a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdc36db204ffd97b947d64374cf23a210dc74777"
        }
      ],
      "title": "Bluetooth: hci_sync: Fix advertising data UAFs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74509",
    "datePublished": "2026-08-15T12:27:31.896Z",
    "dateReserved": "2026-08-15T05:44:03.909Z",
    "dateUpdated": "2026-08-27T12:39:46.394Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74509",
      "date": "2026-09-21",
      "epss": "0.00249",
      "percentile": "0.16539"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:48:38.000Z",
      "cve": "CVE-2026-74509",
      "id": "msrc_CVE-2026-74509",
      "initial_release_date": "2026-08-23T14:48:38.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Bluetooth: hci_sync: Fix advertising data UAFs",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74509.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/hci_sync.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "565971488191bf54a87a417abafab6ad0de72201",
                    "status": "affected",
                    "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c4cec575a6d6f7c36808a3a0017b0675968bb06b",
                    "status": "affected",
                    "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "95cdcd8c82a501931fd3ae9b3811b0b6da167e94",
                    "status": "affected",
                    "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eb1d8318764de7216e6dbba29a24d69f7ce51348",
                    "status": "affected",
                    "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b16ebdbebd2d37f4cdc590bc3e9db71fe90350a3",
                    "status": "affected",
                    "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cdc36db204ffd97b947d64374cf23a210dc74777",
                    "status": "affected",
                    "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "42fe380baaaccbe635c34ca07b29d19b9ec2498d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "affected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/hci_sync.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.17"
                  },
                  {
                    "lessThan": "5.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.184",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.154",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix advertising data UAFs\n\nhci_find_adv_instance() returns an adv_info pointer that is valid only\nwhile hdev-\u003elock is held.  The advertising command-sync paths perform\ninstance lookups without that lock and, in some cases, retain the pointer\nwhile waiting for a controller response.\n\nAn advertising termination event can therefore interleave as follows:\n\n  hci_cmd_sync_work                 hci_rx_work\n  hci_find_adv_instance()\n  __hci_cmd_sync_status()\n    wait for controller reply       hci_dev_lock()\n                                    hci_remove_adv_instance()\n                                      kfree(adv)\n  adv-\u003escan_rsp_changed = false\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in hci_set_ext_scan_rsp_data_sync+0x2e1/0x300\n  Write of size 1 at addr ffff88810a45d21d by task kworker/u17:0/88\n  Workqueue: hci0 hci_cmd_sync_work\n  Call Trace:\n   hci_set_ext_scan_rsp_data_sync+0x2e1/0x300\n   hci_schedule_adv_instance_sync+0x390/0x4c0\n   hci_cmd_sync_work+0x173/0x300\n  Allocated by task 87:\n   hci_add_adv_instance+0x538/0xac0\n   add_advertising+0x885/0x1160\n  Freed by task 89:\n   kfree+0x131/0x3c0\n   hci_remove_adv_instance+0x1d8/0x3b0\n   hci_le_ext_adv_term_evt+0x17b/0x730\n\nProtect the instance lookup and payload construction in the extended\nadvertising, scan response, and periodic advertising data paths.  Snapshot\nthe advertising parameters under hdev-\u003elock, but release the lock before\nwaiting for the controller.\n\nClear advertising-data dirty bits before issuing their commands and\nrestore them after a failure using a fresh lookup.  Likewise, update the\nreported transmit power through a fresh lookup after the parameter command\ncompletes.  No adv_info pointer then survives an HCI command wait."
          }
        ],
        "id": "CVE-2026-74509",
        "lastModified": "2026-08-27T13:18:34.330",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:17:55.950",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/565971488191bf54a87a417abafab6ad0de72201"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/95cdcd8c82a501931fd3ae9b3811b0b6da167e94"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b16ebdbebd2d37f4cdc590bc3e9db71fe90350a3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c4cec575a6d6f7c36808a3a0017b0675968bb06b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cdc36db204ffd97b947d64374cf23a210dc74777"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eb1d8318764de7216e6dbba29a24d69f7ce51348"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-03T21:12:58+00:00",
      "cve": "CVE-2026-74509",
      "id": "CVE-2026-74509",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: hci_sync: Fix advertising data UAFs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74509.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:26:43Z",
      "cve": "CVE-2026-74509",
      "id": "CVE-2026-74509",
      "initial_release_date": "2026-08-15T23:51:21Z",
      "product_status:known_affected": "478",
      "product_status:known_not_affected": "241",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74509",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74509.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.