{
  "cveId": "CVE-2026-74511",
  "url": "https://patchblox.com/security/cve/CVE-2026-74511",
  "summary": "CVE-2026-74511 is fixed in linux on 1 platform by DEBIAN-CVE-2026-74511 (version 7.1.8-1), released August 16, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: mgmt: fix pending command UAF in EIR updates  MGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers and can run set_name_sync().  When the controller is BR/EDR capable, set_name_sync() updates the local name and then rebuilds EIR data through eir_create().  The EIR builder walks hdev-\u003Euuids, but the UUID list can be changed and entries can be freed by MGMT_OP_ADD_UUID and MGMT_OP_REMOVE_UUID.  pending_eir_or_class() is meant to serialize management commands that can change EIR or the class of device, but it did not include MGMT_OP_SET_LOCAL_NAME.  In addition, it walked hdev-\u003Emgmt_pending without hdev-\u003Emgmt_pending_lock even though pending commands are added and removed under that mutex.  A racing command completion can therefore remove and free a pending command while pending_eir_or_class() is still inspecting it, leading to a use-after-free in the pending-command list or allowing a local name update to rebuild EIR while UUID entries are being removed.  Take hdev-\u003Emgmt_pending_lock while scanning hdev-\u003Emgmt_pending and treat MGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting pending command on the powered asynchronous path.  Check for a conflicting pending command before copying the new short name so a rejected SET_LOCAL_NAME request does not modify hdev-\u003Eshort_name.",
  "published": "2026-08-15T13:17:56Z",
  "severity": "Moderate",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-74511",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.8-1",
      "fix": "DEBIAN-CVE-2026-74511",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-74511",
      "released": "2026-08-16T22:48:20Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T13:56:55Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}