GHSA-W59R-GMF8-WG42

Vulnerability from github – Published: 2026-08-15 15:30 – Updated: 2026-08-17 06:33
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: fix pending command UAF in EIR updates

MGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers and can run set_name_sync(). When the controller is BR/EDR capable, set_name_sync() updates the local name and then rebuilds EIR data through eir_create(). The EIR builder walks hdev->uuids, but the UUID list can be changed and entries can be freed by MGMT_OP_ADD_UUID and MGMT_OP_REMOVE_UUID.

pending_eir_or_class() is meant to serialize management commands that can change EIR or the class of device, but it did not include MGMT_OP_SET_LOCAL_NAME. In addition, it walked hdev->mgmt_pending without hdev->mgmt_pending_lock even though pending commands are added and removed under that mutex. A racing command completion can therefore remove and free a pending command while pending_eir_or_class() is still inspecting it, leading to a use-after-free in the pending-command list or allowing a local name update to rebuild EIR while UUID entries are being removed.

Take hdev->mgmt_pending_lock while scanning hdev->mgmt_pending and treat MGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting pending command on the powered asynchronous path. Check for a conflicting pending command before copying the new short name so a rejected SET_LOCAL_NAME request does not modify hdev->short_name.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-74511"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T13:17:56Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix pending command UAF in EIR updates\n\nMGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers\nand can run set_name_sync().  When the controller is BR/EDR capable,\nset_name_sync() updates the local name and then rebuilds EIR data through\neir_create().  The EIR builder walks hdev-\u003euuids, but the UUID list can\nbe changed and entries can be freed by MGMT_OP_ADD_UUID and\nMGMT_OP_REMOVE_UUID.\n\npending_eir_or_class() is meant to serialize management commands that\ncan change EIR or the class of device, but it did not include\nMGMT_OP_SET_LOCAL_NAME.  In addition, it walked hdev-\u003emgmt_pending\nwithout hdev-\u003emgmt_pending_lock even though pending commands are added\nand removed under that mutex.  A racing command completion can therefore\nremove and free a pending command while pending_eir_or_class() is still\ninspecting it, leading to a use-after-free in the pending-command list or\nallowing a local name update to rebuild EIR while UUID entries are being\nremoved.\n\nTake hdev-\u003emgmt_pending_lock while scanning hdev-\u003emgmt_pending and treat\nMGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting pending command on the\npowered asynchronous path.  Check for a conflicting pending command before\ncopying the new short name so a rejected SET_LOCAL_NAME request does not\nmodify hdev-\u003eshort_name.",
  "id": "GHSA-w59r-gmf8-wg42",
  "modified": "2026-08-17T06:33:50Z",
  "published": "2026-08-15T15:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74511"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/35464ff818165131464bd524c259db1ac8044ae3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/814f82f432dc6ee4d15f94756554ff94e6e3ef05"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8f2f62855a41d1730fb9e8122912bd2c8d6bed5d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a9e7c2609b0cb3fb4b4ba9f66dd8727d33205967"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/eacfcb6b735d0e16b4d2ecfde4b9141225ee934e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.