CVE-2026-74528

This CVE is a time-of-check-to-time-of-use race in the hci_past_sync() callback where a connection pointer is passed to hci_conn_valid() without first incrementing its reference count. The window between the check and the dereference is narrow but exploitable: another execution context can free the connection object, and kmalloc can reuse that memory for a different allocation before hci_conn_valid() accesses the pointer. The result is a use-after-free functioning as type confusion — the kernel reads attacker-controlled or stale data from a reallocated slab object rather than a valid connection structure. The CVSS 8 rating is defensible for a kernel-local privilege escalation vector, but the EPSS score of 0.00223 likely understates the real risk for a different reason than you'd expect. The hci_past_sync() callback handles controller-side connection handover for LE Audio and Periodic Advertising with Synchronization Transfer — this is freshly written code added under aggressive specification velocity pressure, not legacy code that rotted through neglect. The triggering conditions aren't well-documented, which means reliable exploitation requires understanding specific Bluetooth controller events and timing windows that aren't trivial to identify or hit from a network-adjacent attacker. What should concern you more than the immediate exploitability is the structural pattern. This exact mutation — async callback dereferences object without holding refcount first, creating a TOCTOU window where slab reuse becomes exploitable — has appeared in USB, then Net, and now Bluetooth. Each gets patched with the mechanical refcount_hold() addition and treated as a one-off. The implicit lifetime contracts in kernel callback APIs remain undocumented by design; there's no compiler or static analysis enforcement preventing the next developer from making the same mistake in whatever new async callback path ships with the next Bluetooth feature. The blast radius extends beyond privilege escalation. If the corrupted connection object poisons handover state, pairing keys, or link policy decisions that propagate to userspace, you may not need a second vulnerability at all. The type-confused dereference contaminates everything downstream that trusts the connection object — and USB, Net, and Bluetooth all share slab caches with the kernel. The patch exists upstream, but your exposure window isn't determined by CVSS math. The hci_past_sync() path sits at the intersection of kernel subsystems with wildly different update cadences: the fix merges into kernel/mainline, but the actual vulnerability lives in dependent kernel modules from SoC vendors and the device-specific firmware blobs implementing controller-side handover. Distributions and Android devices running kernel versions that won't see this backport for six to eighteen months remain exposed regardless of the patch being available. Apply the fix, but treat this as a canary for a class of vulnerability that will recur wherever async callbacks interact with objects that other execution contexts can free.

Reviewed through automated stages and approved by a human before publication.