{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "bdd56875c6926d8009914f427df71797693e90d4"
            },
            {
              "fixed": "a9e7c2609b0cb3fb4b4ba9f66dd8727d33205967"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "4e83f2dbb2bf677e614109df24426c4dded472d4"
            },
            {
              "fixed": "eacfcb6b735d0e16b4d2ecfde4b9141225ee934e"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6fe26f694c824b8a4dbf50c635bee1302e3f099c"
            },
            {
              "fixed": "814f82f432dc6ee4d15f94756554ff94e6e3ef05"
            },
            {
              "fixed": "35464ff818165131464bd524c259db1ac8044ae3"
            },
            {
              "fixed": "8f2f62855a41d1730fb9e8122912bd2c8d6bed5d"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "d7882db79135c829a922daf3571f33ea1e056ae3"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.6.94"
            },
            {
              "fixed": "6.6.151"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.12.34"
            },
            {
              "fixed": "6.12.103"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.15.3"
            },
            {
              "fixed": "6.16"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.6.151"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.103"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.44"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.16.0"
            },
            {
              "fixed": "7.1.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74511.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix pending command UAF in EIR updates\n\nMGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers\nand can run set_name_sync().  When the controller is BR/EDR capable,\nset_name_sync() updates the local name and then rebuilds EIR data through\neir_create().  The EIR builder walks hdev-\u003euuids, but the UUID list can\nbe changed and entries can be freed by MGMT_OP_ADD_UUID and\nMGMT_OP_REMOVE_UUID.\n\npending_eir_or_class() is meant to serialize management commands that\ncan change EIR or the class of device, but it did not include\nMGMT_OP_SET_LOCAL_NAME.  In addition, it walked hdev-\u003emgmt_pending\nwithout hdev-\u003emgmt_pending_lock even though pending commands are added\nand removed under that mutex.  A racing command completion can therefore\nremove and free a pending command while pending_eir_or_class() is still\ninspecting it, leading to a use-after-free in the pending-command list or\nallowing a local name update to rebuild EIR while UUID entries are being\nremoved.\n\nTake hdev-\u003emgmt_pending_lock while scanning hdev-\u003emgmt_pending and treat\nMGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting pending command on the\npowered asynchronous path.  Check for a conflicting pending command before\ncopying the new short name so a rejected SET_LOCAL_NAME request does not\nmodify hdev-\u003eshort_name.",
  "id": "CVE-2026-74511",
  "modified": "2026-08-21T03:30:33.970275540Z",
  "published": "2026-08-15T12:27:33.116Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/35464ff818165131464bd524c259db1ac8044ae3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/814f82f432dc6ee4d15f94756554ff94e6e3ef05"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8f2f62855a41d1730fb9e8122912bd2c8d6bed5d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a9e7c2609b0cb3fb4b4ba9f66dd8727d33205967"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/eacfcb6b735d0e16b4d2ecfde4b9141225ee934e"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74511.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74511"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Bluetooth: mgmt: fix pending command UAF in EIR updates"
}