CVE-2026-74510

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: mgmt: fix UAF in pair command cancellation<br /> <br /> The pairing completion and authentication failure callbacks look up the<br /> pending MGMT_OP_PAIR_DEVICE command by walking hdev-&gt;mgmt_pending. The<br /> lookup returned a command that was still linked on the shared pending list,<br /> without keeping mgmt_pending_lock held for the later dereference and<br /> removal.<br /> <br /> A concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the<br /> same pending command before the callback uses it. The reverse race is also<br /> possible when cancel_pair_device() gets a command from pending_find() and a<br /> callback removes it before the cancel path dereferences it. This can lead<br /> to a use-after-free and a second list_del().<br /> <br /> Make the pairing lookup helpers transfer ownership of the pending command<br /> by removing it from hdev-&gt;mgmt_pending while holding mgmt_pending_lock.<br /> The callbacks and cancel path then complete the command and free it<br /> directly, so racing paths cannot find or free the same command again. Take<br /> a temporary hci_conn reference in cancel_pair_device() because the command<br /> completion drops the reference stored in the pending command.