{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/mixer_quirks.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b3a346d5c99dd73cf84711f2a43e42691990efd2",
              "status": "affected",
              "version": "611a96f6acf2e74fe28cb90908a9c183862348ce",
              "versionType": "git"
            },
            {
              "lessThan": "7ba01e0d3539d9cf0aef3e82938f1648147744cc",
              "status": "affected",
              "version": "611a96f6acf2e74fe28cb90908a9c183862348ce",
              "versionType": "git"
            },
            {
              "lessThan": "98dbfbb38e297c25c5b0af4a9018d71ac25e8554",
              "status": "affected",
              "version": "611a96f6acf2e74fe28cb90908a9c183862348ce",
              "versionType": "git"
            },
            {
              "lessThan": "441aaad150c57edaf57ee482a79a3bf4c5b7e353",
              "status": "affected",
              "version": "611a96f6acf2e74fe28cb90908a9c183862348ce",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3089703ab71484a8b9a7641051181d11d60f870c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "50f63f11a6ddaa0d34574df72b3fa6ee257c057d",
              "versionType": "git"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/mixer_quirks.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix stack info leak in RME Digiface status\n\nsnd_rme_digiface_read_status() reads a four-word status block from the\ndevice into an uninitialised on-stack __le32 buf[4] and, whenever the\nvendor control-IN transfer does not return a negative error, copies all\nfour words into the caller\u0027s status[].\n\nsnd_usb_ctl_msg() copies the full requested size back into the caller\u0027s\nbuffer regardless of how many bytes the data stage actually delivered:\n\n\tbuf = kmemdup(data, size, GFP_KERNEL);\n\terr = usb_control_msg(dev, pipe, request, requesttype,\n\t\t\t      value, index, buf, size, timeout);\n\tmemcpy(data, buf, size);\n\nusb_control_msg() returns the transferred length on a short control-IN,\nwhich is a non-negative value, and writes only that many bytes.  The\nremainder of the copy back is the kmemdup()ed image of the caller\u0027s\nbuffer, so a device answering with a short data stage leaves the\ntrailing words of buf[] holding leftover kernel stack.  The only guard\nin the caller is err \u003c 0, so those words are stored into status[].\n\nThey then reach user space: snd_rme_digiface_get_status_val() selects a\n16-bit halfword of status[] per the control\u0027s reg/mask, and the eight\nDigiface status controls together expose the whole 16-byte frame to an\nunprivileged reader of /dev/snd/controlC*.\n\nZero-initialise the buffer so a short read yields zeros instead of stack\nresidue.  This mirrors snd_rme_get_status1(), which already clears its\noutput word before the same kind of vendor read.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:20:38.636Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b3a346d5c99dd73cf84711f2a43e42691990efd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ba01e0d3539d9cf0aef3e82938f1648147744cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/98dbfbb38e297c25c5b0af4a9018d71ac25e8554"
        },
        {
          "url": "https://git.kernel.org/stable/c/441aaad150c57edaf57ee482a79a3bf4c5b7e353"
        }
      ],
      "title": "ALSA: usb-audio: fix stack info leak in RME Digiface status",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74500",
    "datePublished": "2026-08-15T12:27:26.359Z",
    "dateReserved": "2026-08-15T05:44:03.907Z",
    "dateUpdated": "2026-08-17T05:20:38.636Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/midi2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "49eccef6d6e1c00dac6fb2e7eb6f9206c33e1c37",
              "status": "affected",
              "version": "ff49d1df79aef7580fe3ac99d17c3f886655d080",
              "versionType": "git"
            },
            {
              "lessThan": "8a7a33b846d6ba695891b8d0040027cdbad8cd52",
              "status": "affected",
              "version": "ff49d1df79aef7580fe3ac99d17c3f886655d080",
              "versionType": "git"
            },
            {
              "lessThan": "cc014ebf803174f0e5d15956dfc5a38413c945ae",
              "status": "affected",
              "version": "ff49d1df79aef7580fe3ac99d17c3f886655d080",
              "versionType": "git"
            },
            {
              "lessThan": "ae388c0e1bf727972096f770f82d12e4f748d1b6",
              "status": "affected",
              "version": "ff49d1df79aef7580fe3ac99d17c3f886655d080",
              "versionType": "git"
            },
            {
              "lessThan": "4a05b2d1b4642df74f30b6f54843e825c4a2bfd3",
              "status": "affected",
              "version": "ff49d1df79aef7580fe3ac99d17c3f886655d080",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/midi2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix use-after-free in ump_to_endpoint()\n\ncreate_midi2_ump() registers a card-owned snd_ump_endpoint and stores a\nback-pointer to its per-interface snd_usb_midi2_ump object in\nump-\u003eprivate_data, but it never installs an ump-\u003eprivate_free hook and\nnever clears that pointer.\n\nIf a later step of snd_usb_midi_v2_create() fails, its error path calls\nfree_all_midi2_umps(), which kfree()s the snd_usb_midi2_ump object while\nthe already-registered endpoint keeps pointing at it.  The created\n/dev/snd/umpC*D* node stays exposed, so the first operation of any UMP\nopen, ump_to_endpoint(), dereferences the dangling ump-\u003eprivate_data and\nreads rmidi-\u003eeps[dir] out of freed memory.\n\nA malicious USB MIDI 2.0 device that makes creation fail after the\nendpoint is registered can thus trigger a slab use-after-free read on a\nsubsequent open of the UMP node.\n\nClear the endpoint\u0027s back-pointer before freeing the object, and let\nump_to_endpoint() tolerate a NULL private_data so the open/close/trigger\ncallbacks fail cleanly (their callers already handle a NULL endpoint)\ninstead of dereferencing a stale pointer.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:20:39.729Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/49eccef6d6e1c00dac6fb2e7eb6f9206c33e1c37"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a7a33b846d6ba695891b8d0040027cdbad8cd52"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc014ebf803174f0e5d15956dfc5a38413c945ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae388c0e1bf727972096f770f82d12e4f748d1b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a05b2d1b4642df74f30b6f54843e825c4a2bfd3"
        }
      ],
      "title": "ALSA: usb-audio: fix use-after-free in ump_to_endpoint()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74501",
    "datePublished": "2026-08-15T12:27:26.957Z",
    "dateReserved": "2026-08-15T05:44:03.907Z",
    "dateUpdated": "2026-08-17T05:20:39.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/core/ump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e84d2e53a05c78a04d1343eeb0f31a79456e79fc",
              "status": "affected",
              "version": "33cd7630782df2230529c3e8f1a6d0ae9cd6ab49",
              "versionType": "git"
            },
            {
              "lessThan": "3302aaeac4f7ee6b775850db21d5f61064ce70ad",
              "status": "affected",
              "version": "33cd7630782df2230529c3e8f1a6d0ae9cd6ab49",
              "versionType": "git"
            },
            {
              "lessThan": "032746c2dd9a4ea0774b04ac8a29e2ea628f106e",
              "status": "affected",
              "version": "33cd7630782df2230529c3e8f1a6d0ae9cd6ab49",
              "versionType": "git"
            },
            {
              "lessThan": "c57001f55f97ef856fb6527e376c5c4a056a53a4",
              "status": "affected",
              "version": "33cd7630782df2230529c3e8f1a6d0ae9cd6ab49",
              "versionType": "git"
            },
            {
              "lessThan": "70c977815af0d997feb2d0c5d284d55689bf7051",
              "status": "affected",
              "version": "33cd7630782df2230529c3e8f1a6d0ae9cd6ab49",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/core/ump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ump: fix double free of out_cvts on rawmidi error\n\nsnd_ump_attach_legacy_rawmidi() allocates the legacy conversion array\nump-\u003eout_cvts and, on the snd_rawmidi_new() error path, frees it with\nkfree() but leaves ump-\u003eout_cvts pointing at the freed memory.  When the\nendpoint is later torn down, snd_ump_endpoint_free() frees ump-\u003eout_cvts\na second time, resulting in a double free.\n\nThe host snd-usb-audio driver attaches the legacy rawmidi for any USB\nMIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail\nreaches this path on enumeration.\n\nClear ump-\u003eout_cvts after freeing it on the error path so it is not\nfreed again during teardown.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:20:40.831Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e84d2e53a05c78a04d1343eeb0f31a79456e79fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/3302aaeac4f7ee6b775850db21d5f61064ce70ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/032746c2dd9a4ea0774b04ac8a29e2ea628f106e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c57001f55f97ef856fb6527e376c5c4a056a53a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/70c977815af0d997feb2d0c5d284d55689bf7051"
        }
      ],
      "title": "ALSA: ump: fix double free of out_cvts on rawmidi error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74502",
    "datePublished": "2026-08-15T12:27:27.586Z",
    "dateReserved": "2026-08-15T05:44:03.907Z",
    "dateUpdated": "2026-08-17T05:20:40.831Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/core/timer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bb016091010ec401a06e6bdace0cd944ee03d371",
              "status": "affected",
              "version": "586b219a22b1032b28b8bd356b963276c5e5bf53",
              "versionType": "git"
            },
            {
              "lessThan": "a26a2e52736f9e39843ca66a2e1ce6bf1adbcd1e",
              "status": "affected",
              "version": "f46093dd22969037beb1fce2e043f3236be41c92",
              "versionType": "git"
            },
            {
              "lessThan": "0c561fab50991df10b1e4daca25886c34a2a9c07",
              "status": "affected",
              "version": "da3039e91d1f835874ed6e9a33ea19ee80c2cb92",
              "versionType": "git"
            },
            {
              "lessThan": "c2744d5f3aea474513fd2298daecb94a952ce441",
              "status": "affected",
              "version": "da3039e91d1f835874ed6e9a33ea19ee80c2cb92",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.103",
              "status": "affected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.44",
              "status": "affected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "7.0.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/core/timer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.12.94",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.18.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "7.0.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes\n\nsnd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD\nand returns early when the flag is already set, but the flag is never\ncleared again.  A completed close ends in remove_slave_links(), which\nleaves timeri-\u003etimer NULL, so a second close is already harmless through\nthe timer == NULL path; the early return can only be reached by an\ninstance that was opened again in between.  For such an instance the\nclose unlinks nothing, so snd_timer_instance_free() frees an object that\nis still on timer-\u003eopen_list_head, still on snd_timer_master_list if it\nwas opened with a slave key, still owns any adopted slaves, and still\nholds its timer and module references.\n\nsnd_seq_timer_open() reopens an instance exactly like that: it retries\nits fallback open on the same object after a failure that has already\nrun snd_timer_close_locked() internally.  An unprivileged user with\naccess to /dev/snd/timer and /dev/snd/seq can force that failure, since\nsnd_timer_check_master() returns -EBUSY when a pending slave matches the\nnew master\u0027s (slave_class, slave_id) key and the target timer has\nreached max_instances, and SNDRV_TIMER_IOCTL_SELECT with dev_class =\nSNDRV_TIMER_CLASS_SLAVE keeps the caller-supplied dev_sclass, so a\nsequencer queue\u0027s key can be forged.  The freed instance is afterwards\ndereferenced by any further snd_timer_open() on that timer, by\nsnd_timer_check_slave(), and by /proc/asound/timers, which faults on the\nstale ti-\u003eowner pointer.\n\nThe flag only has to be visible while the close is in progress, which is\nall its other users need.  Clear it in remove_slave_links(), under the\nsame timer-\u003elock that sets it, once the instance is off every list."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local ioctl access to /dev/snd/timer and /dev/snd/seq to forge timer slave keys and drive snd_seq_timer_open() retry logic; there is no network, adjacent-wireless, or physical-device entry path.\nAC:L - The attacker fully controls the ioctl and sequencer queue sequence that forces the initial -EBUSY close, retries snd_timer_open() on the same instance, and later triggers free; no uncontrollable timing, memory layout, or rare kernel state is required beyond standard ALSA being enabled.\nPR:L - The fix commit and reachable ioctl paths require only an unprivileged local user with access to ALSA device nodes (/dev/snd/timer and /dev/snd/seq), typical on desktops, kiosks, and Android systems via the audio group or equivalent permissions, not real root in the init namespace.\nUI:N - Exploitation is self-contained through attacker-initiated timer SELECT ioctls and sequencer queue open/close operations; no victim interaction such as opening files, mounting filesystems, or clicking prompts is required.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel address space; it does not cross a VM, container, or IOMMU security boundary into a separate authority.\nC:H - A use-after-free of snd_timer_instance leaves dangling list pointers; freed memory can be reallocated and later dereferenced by snd_timer_open(), snd_timer_check_slave(), or /proc/asound/timers, enabling arbitrary kernel memory read primitives.\nI:H - The UAF frees a structure still linked on timer open/master lists while retaining timer and module references, allowing heap reuse and memory corruption that can be leveraged for arbitrary kernel writes or control-flow hijacking.\nA:H - Stale timer instance pointers are dereferenced during subsequent timer operations and /proc/asound/timers reads, causing kernel faults/oops; UAF reliably threatens crashes even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:47:54.696Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bb016091010ec401a06e6bdace0cd944ee03d371"
        },
        {
          "url": "https://git.kernel.org/stable/c/a26a2e52736f9e39843ca66a2e1ce6bf1adbcd1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c561fab50991df10b1e4daca25886c34a2a9c07"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2744d5f3aea474513fd2298daecb94a952ce441"
        }
      ],
      "title": "ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74503",
    "datePublished": "2026-08-15T12:27:28.208Z",
    "dateReserved": "2026-08-15T05:44:03.908Z",
    "dateUpdated": "2026-08-17T05:47:54.696Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/core/seq/seq_timer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d0e19932875746118e298b4c974f3b2d4aeb16fc",
              "status": "affected",
              "version": "37745918e0e7575bc40f38da93a99b9fa6406224",
              "versionType": "git"
            },
            {
              "lessThan": "5260e195c53e898a4a76527d4bb2178f31795e78",
              "status": "affected",
              "version": "37745918e0e7575bc40f38da93a99b9fa6406224",
              "versionType": "git"
            },
            {
              "lessThan": "42c6543ff27ea280334244458d4f52ec7133cc05",
              "status": "affected",
              "version": "37745918e0e7575bc40f38da93a99b9fa6406224",
              "versionType": "git"
            },
            {
              "lessThan": "21e19688433452dfbbbe6b2bb670dea6eb92f0f6",
              "status": "affected",
              "version": "37745918e0e7575bc40f38da93a99b9fa6406224",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/core/seq/seq_timer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Fix division by zero in initialize_timer()\n\nA userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set\nthe backing snd_timer\u0027s hardware resolution to an arbitrary 64-bit value\nvia SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero.\n\nWhen such a timer is bound to a sequencer queue, initialize_timer()\ncomputes the tick period as\n\n\ttmr-\u003eticks = 1000000000 / (r * freq);\n\nwhere r is that user-controlled resolution and freq is the sequencer\nupdate rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250).\nA resolution of 2^63 makes the 64-bit product r * freq wrap to zero for\nany even freq, including DEFAULT_FREQUENCY (1000), so the division faults\nwith a divide-by-zero.\n\nThe division runs under tmr-\u003elock with interrupts disabled, so the oops\nleaves the spinlock held and hangs the CPU. It is reachable by an\nunprivileged user with access to /dev/snd/timer and /dev/snd/seq.\n\n  Oops: divide error: 0000 [#1] SMP KASAN PTI\n  CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+\n  RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0\n   snd_seq_timer_start+0x15e/0x2b0\n   snd_seq_control_queue+0x56f/0xba0\n   snd_seq_write+0x3e0/0x730\n\nReject an overflowing product with check_mul_overflow() and fall back to\na single tick, which also avoids feeding a wrapped-but-nonzero divisor\n(e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small\nvalue) into the period computation."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:20:43.047Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d0e19932875746118e298b4c974f3b2d4aeb16fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/5260e195c53e898a4a76527d4bb2178f31795e78"
        },
        {
          "url": "https://git.kernel.org/stable/c/42c6543ff27ea280334244458d4f52ec7133cc05"
        },
        {
          "url": "https://git.kernel.org/stable/c/21e19688433452dfbbbe6b2bb670dea6eb92f0f6"
        }
      ],
      "title": "ALSA: seq: Fix division by zero in initialize_timer()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74504",
    "datePublished": "2026-08-15T12:27:28.829Z",
    "dateReserved": "2026-08-15T05:44:03.908Z",
    "dateUpdated": "2026-08-17T05:20:43.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/6fire/chip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d41bfea14ee6e063a953f6e72046088737c4e66c",
              "status": "affected",
              "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
              "versionType": "git"
            },
            {
              "lessThan": "8b7ecb2446845fa8d1f1ce9aac6307caac50cfd5",
              "status": "affected",
              "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
              "versionType": "git"
            },
            {
              "lessThan": "a0bb5b9d39e54888385dc399c899223299201fe6",
              "status": "affected",
              "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
              "versionType": "git"
            },
            {
              "lessThan": "49bc7741cd2761c703a292dc69245041ae8a67bd",
              "status": "affected",
              "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
              "versionType": "git"
            },
            {
              "lessThan": "2de734dcbb210bd59983e13d36988acbcc122194",
              "status": "affected",
              "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
              "versionType": "git"
            },
            {
              "lessThan": "11e2953d9f4c7c3d2af94a889c2d805c537d633f",
              "status": "affected",
              "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
              "versionType": "git"
            },
            {
              "lessThan": "630c8d6a93cbd9b2a207f1a67ef1fd21af098b0c",
              "status": "affected",
              "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
              "versionType": "git"
            },
            {
              "lessThan": "a54bf16965f896415c3337bc4fbb40fb11941d99",
              "status": "affected",
              "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/6fire/chip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.39"
            },
            {
              "lessThan": "2.6.39",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: Fix UAF at error handling during probe\n\nAlthough 6fire driver had a few fixes for dealing with the early error\nhandling during the probe phase, it forgot a pending URB before\nfreeing the resources, which may lead to a UAF.\n\nThis patch addresses it by doing the almost same cleanup procedure\nlike the normal disconnect phase at the error path."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:38:02.508Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d41bfea14ee6e063a953f6e72046088737c4e66c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b7ecb2446845fa8d1f1ce9aac6307caac50cfd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0bb5b9d39e54888385dc399c899223299201fe6"
        },
        {
          "url": "https://git.kernel.org/stable/c/49bc7741cd2761c703a292dc69245041ae8a67bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/2de734dcbb210bd59983e13d36988acbcc122194"
        },
        {
          "url": "https://git.kernel.org/stable/c/11e2953d9f4c7c3d2af94a889c2d805c537d633f"
        },
        {
          "url": "https://git.kernel.org/stable/c/630c8d6a93cbd9b2a207f1a67ef1fd21af098b0c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a54bf16965f896415c3337bc4fbb40fb11941d99"
        }
      ],
      "title": "ALSA: 6fire: Fix UAF at error handling during probe",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74505",
    "datePublished": "2026-08-15T12:27:29.436Z",
    "dateReserved": "2026-08-15T05:44:03.908Z",
    "dateUpdated": "2026-08-19T16:38:02.508Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hidp/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "011bf4350d941f1995b2bd4b815ee206cacf2b8e",
              "status": "affected",
              "version": "0ff1731a1ae51e8e48cd559d70db536281c47f8e",
              "versionType": "git"
            },
            {
              "lessThan": "689d8bb7fee96b7196b572b015b6055c6616ce0c",
              "status": "affected",
              "version": "0ff1731a1ae51e8e48cd559d70db536281c47f8e",
              "versionType": "git"
            },
            {
              "lessThan": "c73beb320f5705e508bf7d385b8cc5ef8d9c8b69",
              "status": "affected",
              "version": "0ff1731a1ae51e8e48cd559d70db536281c47f8e",
              "versionType": "git"
            },
            {
              "lessThan": "b7ad105d46acd828e424454815e4cd31069e047a",
              "status": "affected",
              "version": "0ff1731a1ae51e8e48cd559d70db536281c47f8e",
              "versionType": "git"
            },
            {
              "lessThan": "7e7162427659b70ea17cd41b1f79e2e64c246690",
              "status": "affected",
              "version": "0ff1731a1ae51e8e48cd559d70db536281c47f8e",
              "versionType": "git"
            },
            {
              "lessThan": "27cc0e603355c585f1e5da8398faa4d36d498188",
              "status": "affected",
              "version": "0ff1731a1ae51e8e48cd559d70db536281c47f8e",
              "versionType": "git"
            },
            {
              "lessThan": "9c841f59e10b5d75c398a3fc6b2da448d2a2276b",
              "status": "affected",
              "version": "0ff1731a1ae51e8e48cd559d70db536281c47f8e",
              "versionType": "git"
            },
            {
              "lessThan": "34f53d27b81a16a02828c8fdfa4e02badc326f17",
              "status": "affected",
              "version": "0ff1731a1ae51e8e48cd559d70db536281c47f8e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hidp/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.39"
            },
            {
              "lessThan": "2.6.39",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HIDP: validate numbered report payloads\n\nWhen hidp_get_raw_report() waits for a numbered report,\nhidp_process_data() compares the expected report number with skb-\u003edata[0].\nA connected HIDP peer can reply with only a DATA transaction header,\nleaving the skb empty after the header is removed.\n\nKMSAN reports an uninitialized-value use in hidp_session_run(), with the\nvalue originating in __alloc_skb() through vhci_write(). The transaction\nheader checks remove the empty-frame reports, but this report remains until\nthe payload check is added.\n\nThe comparison can also consume a peer-controlled byte beyond the declared\nL2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made\nthe current code accept that byte as report ID 1 and complete\nHIDIOCGFEATURE with a zero-byte result. With this change the malformed\nresponse is rejected with -EIO, while a subsequent valid response still\nsucceeds.\n\nRequire a payload byte before comparing a numbered report ID. Unnumbered\nreports continue to accept an empty payload."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The flaw is reached when a connected Bluetooth HIDP peer sends crafted DATA frames over the established L2CAP control channel; Bluetooth is an adjacent wireless vector, not local syscall/ioctl or physical USB access.\nAC:L - The malicious peer receives the host GET_REPORT and can deterministically reply with a header-only DATA frame or a malformed numbered-report payload; no race or rare layout conditions beyond an active HIDP session are required.\nPR:N - Exploitation is performed by the remote Bluetooth HIDP peer sending malicious protocol data; the attacker needs no local account, capabilities, or init-namespace root on the victim host.\nUI:N - Once a HIDP session exists, the peer can trigger the bug by answering host-initiated GET_REPORT requests from HIDIOCGFEATURE or kernel HID probe I/O without any additional victim action at exploit time.\nS:U - Impact is confined to kernel Bluetooth HIDP/hidraw handling on the victim host; it does not cross a VM, container, or IOMMU security boundary to affect a separate authority.\nC:H - With numbered reports, hidp_process_data() reads skb-\u003edata[0] when skb-\u003elen is zero or beyond the declared L2CAP PDU, causing an out-of-bounds/uninitialized heap read that may contain stale kernel memory.\nI:L - Accepting malformed numbered-report responses can complete HIDIOCGFEATURE with incorrect zero-length or attacker-chosen report-ID data, causing limited integrity impact on returned HID feature-report contents.\nA:N - The defect is an invalid payload-length check and uninitialized/OOB read during report matching; it does not cause a documented kernel oops, panic, hang, or repeatable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:38:05.065Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/011bf4350d941f1995b2bd4b815ee206cacf2b8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/689d8bb7fee96b7196b572b015b6055c6616ce0c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c73beb320f5705e508bf7d385b8cc5ef8d9c8b69"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7ad105d46acd828e424454815e4cd31069e047a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e7162427659b70ea17cd41b1f79e2e64c246690"
        },
        {
          "url": "https://git.kernel.org/stable/c/27cc0e603355c585f1e5da8398faa4d36d498188"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c841f59e10b5d75c398a3fc6b2da448d2a2276b"
        },
        {
          "url": "https://git.kernel.org/stable/c/34f53d27b81a16a02828c8fdfa4e02badc326f17"
        }
      ],
      "title": "Bluetooth: HIDP: validate numbered report payloads",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74507",
    "datePublished": "2026-08-15T12:27:30.683Z",
    "dateReserved": "2026-08-15T05:44:03.908Z",
    "dateUpdated": "2026-08-19T16:38:05.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hidp/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "24c64ccd5c1fc9934b427335b0d976c7f2b1a7d8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "238c333bc4b3f245c626632e8bfa3c9dab97f51b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "567a2a0a633f2ea5fdccaf3517c09f22c9d860c7",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "46ca5ab39737d7c6f9ca77ecf714cdcfa6caaeec",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "97b61241ab45bfa5b0526cb0f3978942493bc811",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2ebf63aa557a69990b4e9ea22be224d58aabce96",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "854194494a6f726a60b90b76059148bf08df023d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "47778d2c2087b5d192398f6fddf692d16a5431cf",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hidp/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HIDP: reject frames without a transaction header\n\nhidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb-\u003edata[0]\nbefore checking that the L2CAP SDU contains a transaction header. A\nconnected HIDP peer can send an empty basic-mode SDU and make both paths\nuse an uninitialized byte from skb tailroom.\n\nKMSAN reports the use in hidp_session_run(), with the uninitialized value\noriginating in __alloc_skb() through vhci_write(). The control path\nproduces two reports and the interrupt path produces one.\n\nThe byte can also be controlled by a malformed lower-layer packet. If an\nHCI ACL packet contains an L2CAP PDU with a declared zero-length payload\nfollowed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb-\u003elen to\nthe declared PDU length before dispatch. The current HIDP path nevertheless\nconsumes the extra byte as HIDP_TRANS_HID_CONTROL |\nHIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this\nchange, the same packet is discarded and a subsequent feature report\nrequest succeeds.\n\nPull the transaction header with skb_pull_data() and discard frames that\ndo not contain it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Malicious or malformed Bluetooth L2CAP SDUs reach hidp_recv_ctrl_frame()/hidp_recv_intr_frame() from a radio-adjacent peer via hci_acl_packet() -\u003e l2cap_recv_acldata() -\u003e l2cap_recv_frame() -\u003e l2cap_sock_recv_cb() -\u003e hidp_session_run().\nAC:L - A connected HIDP peer reliably triggers the bug by sending empty basic-mode SDUs or zero-length L2CAP PDUs with trailing bytes; the attacker controls both sides of the malformed-packet condition without races or rare kernel configs.\nPR:N - Exploitation requires only delivering crafted Bluetooth ACL/L2CAP traffic as the connected peer; the victim attacker does not need local accounts, capabilities, or CAP_NET_ADMIN on the target host.\nUI:N - Once a normal Bluetooth HID session is active (typical paired keyboard/mouse/headset use), the attacker can send malicious frames without any additional victim interaction during exploitation.\nS:U - The flaw affects kernel Bluetooth HIDP session handling only and does not cross VM, container, or IOMMU security boundaries; impact stays within the kernel Bluetooth/HID authority.\nC:H - On zero-length SDUs, hidp_recv_*_frame() reads skb-\u003edata[0] from uninitialized skb tailroom (KMSAN via vhci_write/__alloc_skb), leaking kernel heap bytes that drive subsequent protocol parsing.\nI:H - Attacker-controlled header bytes (e.g., malformed PDU trailing 0x15 = HIDP_TRANS_HID_CONTROL|HIDP_CTRL_VIRTUAL_CABLE_UNPLUG) force hidp_process_hid_control() to tear down sessions and can misroute other transaction types through handshake/data handlers.\nA:H - Forged virtual-cable-unplug and related control-path handling forcibly terminates active HIDP sessions, completely denying Bluetooth HID input/output on phones, laptops, kiosks, and embedded systems until reconnect."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:28.838Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/24c64ccd5c1fc9934b427335b0d976c7f2b1a7d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/238c333bc4b3f245c626632e8bfa3c9dab97f51b"
        },
        {
          "url": "https://git.kernel.org/stable/c/567a2a0a633f2ea5fdccaf3517c09f22c9d860c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/46ca5ab39737d7c6f9ca77ecf714cdcfa6caaeec"
        },
        {
          "url": "https://git.kernel.org/stable/c/97b61241ab45bfa5b0526cb0f3978942493bc811"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ebf63aa557a69990b4e9ea22be224d58aabce96"
        },
        {
          "url": "https://git.kernel.org/stable/c/854194494a6f726a60b90b76059148bf08df023d"
        },
        {
          "url": "https://git.kernel.org/stable/c/47778d2c2087b5d192398f6fddf692d16a5431cf"
        }
      ],
      "title": "Bluetooth: HIDP: reject frames without a transaction header",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74508",
    "datePublished": "2026-08-15T12:27:31.288Z",
    "dateReserved": "2026-08-15T05:44:03.908Z",
    "dateUpdated": "2026-08-23T12:47:28.838Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "565971488191bf54a87a417abafab6ad0de72201",
              "status": "affected",
              "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
              "versionType": "git"
            },
            {
              "lessThan": "c4cec575a6d6f7c36808a3a0017b0675968bb06b",
              "status": "affected",
              "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
              "versionType": "git"
            },
            {
              "lessThan": "95cdcd8c82a501931fd3ae9b3811b0b6da167e94",
              "status": "affected",
              "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
              "versionType": "git"
            },
            {
              "lessThan": "eb1d8318764de7216e6dbba29a24d69f7ce51348",
              "status": "affected",
              "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
              "versionType": "git"
            },
            {
              "lessThan": "b16ebdbebd2d37f4cdc590bc3e9db71fe90350a3",
              "status": "affected",
              "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
              "versionType": "git"
            },
            {
              "lessThan": "cdc36db204ffd97b947d64374cf23a210dc74777",
              "status": "affected",
              "version": "cba6b758711cab946c787f7c15be92cc749b8e1f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "42fe380baaaccbe635c34ca07b29d19b9ec2498d",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.210",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.154",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.210",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix advertising data UAFs\n\nhci_find_adv_instance() returns an adv_info pointer that is valid only\nwhile hdev-\u003elock is held.  The advertising command-sync paths perform\ninstance lookups without that lock and, in some cases, retain the pointer\nwhile waiting for a controller response.\n\nAn advertising termination event can therefore interleave as follows:\n\n  hci_cmd_sync_work                 hci_rx_work\n  hci_find_adv_instance()\n  __hci_cmd_sync_status()\n    wait for controller reply       hci_dev_lock()\n                                    hci_remove_adv_instance()\n                                      kfree(adv)\n  adv-\u003escan_rsp_changed = false\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in hci_set_ext_scan_rsp_data_sync+0x2e1/0x300\n  Write of size 1 at addr ffff88810a45d21d by task kworker/u17:0/88\n  Workqueue: hci0 hci_cmd_sync_work\n  Call Trace:\n   hci_set_ext_scan_rsp_data_sync+0x2e1/0x300\n   hci_schedule_adv_instance_sync+0x390/0x4c0\n   hci_cmd_sync_work+0x173/0x300\n  Allocated by task 87:\n   hci_add_adv_instance+0x538/0xac0\n   add_advertising+0x885/0x1160\n  Freed by task 89:\n   kfree+0x131/0x3c0\n   hci_remove_adv_instance+0x1d8/0x3b0\n   hci_le_ext_adv_term_evt+0x17b/0x730\n\nProtect the instance lookup and payload construction in the extended\nadvertising, scan response, and periodic advertising data paths.  Snapshot\nthe advertising parameters under hdev-\u003elock, but release the lock before\nwaiting for the controller.\n\nClear advertising-data dirty bits before issuing their commands and\nrestore them after a failure using a fresh lookup.  Likewise, update the\nreported transmit power through a fresh lookup after the parameter command\ncompletes.  No adv_info pointer then survives an HCI command wait."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in the Bluetooth HCI LE extended-advertising path; a remote/adjacent peer can deliver the LE Extended Advertising Set Terminated HCI event that frees adv_info while hci_cmd_sync_work waits on the controller during scan-response/advertising-data updates on phones and other BLE devices.\nAC:L - This is a use-after-free race between hci_cmd_sync_work and hci_rx_work where the attacker controls the terminating side by repeatedly initiating BLE connections/terminations during the up-to-2s HCI command wait, and can also drive the setup side via MGMT advertising commands.\nPR:N - An adjacent Bluetooth attacker needs no account, credentials, or capabilities on the victim; exploitation only requires the victim stack to be configuring BLE advertising (normal on Android phones, laptops, and IoT) while the attacker sends over-the-air BLE traffic to trigger hci_le_ext_adv_term_evt.\nUI:N - No deliberate victim action is required beyond a device running Bluetooth with LE advertising updates (common default behavior); the attacker triggers the race remotely without social engineering, file opens, or mounts.\nS:U - Impact is kernel heap corruption and potential local privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary.\nC:H - Multiple UAF paths read freed adv_info (e.g., eir_create_scan_rsp/adv_data) and retain dangling pointers across __hci_cmd_sync_status waits, enabling slab reuse and arbitrary kernel memory disclosure via heap grooming.\nI:H - KASAN shows a post-free write to adv_info (scan_rsp_changed); similar paths write adv_data_changed and tx_power on freed objects, providing exploitable heap corruption for arbitrary kernel writes and code execution.\nA:H - Use-after-free on adv_info in hci_cmd_sync_work can cause immediate kernel oops/panic or hung BLE subsystem during advertising reconfiguration, and is reachable from unauthenticated adjacent BLE interaction on actively advertising devices."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:39:46.394Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/565971488191bf54a87a417abafab6ad0de72201"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4cec575a6d6f7c36808a3a0017b0675968bb06b"
        },
        {
          "url": "https://git.kernel.org/stable/c/95cdcd8c82a501931fd3ae9b3811b0b6da167e94"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb1d8318764de7216e6dbba29a24d69f7ce51348"
        },
        {
          "url": "https://git.kernel.org/stable/c/b16ebdbebd2d37f4cdc590bc3e9db71fe90350a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdc36db204ffd97b947d64374cf23a210dc74777"
        }
      ],
      "title": "Bluetooth: hci_sync: Fix advertising data UAFs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74509",
    "datePublished": "2026-08-15T12:27:31.896Z",
    "dateReserved": "2026-08-15T05:44:03.909Z",
    "dateUpdated": "2026-08-27T12:39:46.394Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "50af4280a587c9971b5388cbc438f1324e626b7b",
              "status": "affected",
              "version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
              "versionType": "git"
            },
            {
              "lessThan": "86ed4dd6548ccf277bc691bc912ca06e76b9d80c",
              "status": "affected",
              "version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
              "versionType": "git"
            },
            {
              "lessThan": "7c2a152a897cd1c184b2051484d4f74d803e7f4a",
              "status": "affected",
              "version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
              "versionType": "git"
            },
            {
              "lessThan": "c569def320aa8b1fde89227e2ea96606790fd86d",
              "status": "affected",
              "version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
              "versionType": "git"
            },
            {
              "lessThan": "51be7280980fddc90ebe874a69c2fe8ab02bb46a",
              "status": "affected",
              "version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
              "versionType": "git"
            },
            {
              "lessThan": "d0a7b48ad0921bd88effaee10bf970ab1d5d0ddd",
              "status": "affected",
              "version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.39"
            },
            {
              "lessThan": "2.6.39",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix UAF in pair command cancellation\n\nThe pairing completion and authentication failure callbacks look up the\npending MGMT_OP_PAIR_DEVICE command by walking hdev-\u003emgmt_pending. The\nlookup returned a command that was still linked on the shared pending list,\nwithout keeping mgmt_pending_lock held for the later dereference and\nremoval.\n\nA concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the\nsame pending command before the callback uses it. The reverse race is also\npossible when cancel_pair_device() gets a command from pending_find() and a\ncallback removes it before the cancel path dereferences it. This can lead\nto a use-after-free and a second list_del().\n\nMake the pairing lookup helpers transfer ownership of the pending command\nby removing it from hdev-\u003emgmt_pending while holding mgmt_pending_lock.\nThe callbacks and cancel path then complete the command and free it\ndirectly, so racing paths cannot find or free the same command again. Take\na temporary hci_conn reference in cancel_pair_device() because the command\ncompletion drops the reference stored in the pending command."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is triggered through local AF_BLUETOOTH HCI_CHANNEL_CONTROL management commands (hci_sock_bind/sendmsg -\u003e hci_mgmt_cmd -\u003e pair_device/cancel_pair_device); remote Bluetooth peers cannot issue MGMT_OP_PAIR_DEVICE or MGMT_OP_CANCEL_PAIR_DEVICE over the air.\nAC:L - An attacker controls the race by concurrently issuing MGMT_OP_PAIR_DEVICE and MGMT_OP_CANCEL_PAIR_DEVICE from threads or sockets they own while pairing HCI callbacks fire, and can retry until cancel and completion/auth/SMP paths interleave on the same pending command.\nPR:L - pair_device and cancel_pair_device lack HCI_MGMT_UNTRUSTED and require HCI_SOCK_TRUSTED (CAP_NET_ADMIN at bind); per kernel CNA guidance CAP_NET_ADMIN reachable via unprivileged user namespaces (unshare -Urn) maps to PR:L, consistent with similar Bluetooth mgmt UAF scores.\nUI:N - No victim interaction is required beyond a powered Bluetooth controller; the attacker directly sends the conflicting PAIR_DEVICE and CANCEL_PAIR_DEVICE management commands that create the pending entry and race the unlocked find_pairing/pending_find paths against completion callbacks.\nS:U - Exploitation corrupts kernel Bluetooth MGMT heap objects (mgmt_pending_cmd) within the same host kernel security authority; this is standard local kernel memory corruption, not a VM, IOMMU, or cross-authority boundary escape.\nC:H - Use-after-free of mgmt_pending_cmd when find_pairing or pending_find returns a still-linked command without holding mgmt_pending_lock through later dereference and mgmt_pending_remove, enabling arbitrary kernel memory disclosure via slab reuse of the freed object.\nI:H - Slab UAF and double list_del on mgmt_pending_cmd during concurrent cancel_pair_device and pairing/auth/SMP completion callbacks provide attacker-influenced heap corruption primitives exploitable for arbitrary kernel writes and control-flow hijacking per kernel UAF guidance.\nA:H - Dereferencing or list_del on a freed mgmt_pending_cmd during the cancel versus callback race causes kernel oops or panic; repeated concurrent PAIR_DEVICE and CANCEL_PAIR_DEVICE commands during active pairing can reliably crash or hang the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:31.049Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/50af4280a587c9971b5388cbc438f1324e626b7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/86ed4dd6548ccf277bc691bc912ca06e76b9d80c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c2a152a897cd1c184b2051484d4f74d803e7f4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c569def320aa8b1fde89227e2ea96606790fd86d"
        },
        {
          "url": "https://git.kernel.org/stable/c/51be7280980fddc90ebe874a69c2fe8ab02bb46a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0a7b48ad0921bd88effaee10bf970ab1d5d0ddd"
        }
      ],
      "title": "Bluetooth: mgmt: fix UAF in pair command cancellation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74510",
    "datePublished": "2026-08-15T12:27:32.503Z",
    "dateReserved": "2026-08-15T05:44:03.909Z",
    "dateUpdated": "2026-08-23T12:47:31.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}