CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: fix UAF in pair command cancellation

The pairing completion and authentication failure callbacks look up the
pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending. The
lookup returned a command that was still linked on the shared pending list,
without keeping mgmt_pending_lock held for the later dereference and
removal.

A concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the
same pending command before the callback uses it. The reverse race is also
possible when cancel_pair_device() gets a command from pending_find() and a
callback removes it before the cancel path dereferences it. This can lead
to a use-after-free and a second list_del().

Make the pairing lookup helpers transfer ownership of the pending command
by removing it from hdev->mgmt_pending while holding mgmt_pending_lock.
The callbacks and cancel path then complete the command and free it
directly, so racing paths cannot find or free the same command again. Take
a temporary hci_conn reference in cancel_pair_device() because the command
completion drops the reference stored in the pending command.

The Linux kernel CVE team has assigned CVE-2026-74510 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.39 with commit e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 and fixed in 6.6.151 with commit 86ed4dd6548ccf277bc691bc912ca06e76b9d80c
	Issue introduced in 2.6.39 with commit e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 and fixed in 6.12.103 with commit 7c2a152a897cd1c184b2051484d4f74d803e7f4a
	Issue introduced in 2.6.39 with commit e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 and fixed in 6.18.44 with commit c569def320aa8b1fde89227e2ea96606790fd86d
	Issue introduced in 2.6.39 with commit e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 and fixed in 7.1.8 with commit 51be7280980fddc90ebe874a69c2fe8ab02bb46a
	Issue introduced in 2.6.39 with commit e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 and fixed in 7.2-rc6 with commit d0a7b48ad0921bd88effaee10bf970ab1d5d0ddd

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74510
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bluetooth/mgmt.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/86ed4dd6548ccf277bc691bc912ca06e76b9d80c
	https://git.kernel.org/stable/c/7c2a152a897cd1c184b2051484d4f74d803e7f4a
	https://git.kernel.org/stable/c/c569def320aa8b1fde89227e2ea96606790fd86d
	https://git.kernel.org/stable/c/51be7280980fddc90ebe874a69c2fe8ab02bb46a
	https://git.kernel.org/stable/c/d0a7b48ad0921bd88effaee10bf970ab1d5d0ddd