CVE-2026-74531 is a use-after-free in the Linux Bluetooth driver's hci_sync layer. The vulnerability exists in connection teardown: when an HCI connection is aborted, the connection object can be freed while an hci_sync worker thread still holds a pointer to it. The fix adds a single refcount_hold() to increment the reference count before the worker accesses the object, preventing premature freeing.
This is a theoretical UAF — detected through code review during the hci_sync migration, not through fuzzing, KASAN, or runtime observation. The hci_sync conversion has been replacing callback-based asynchronous patterns with synchronous semantics across the Bluetooth subsystem for years, and this gap likely emerged from that refactoring. The old async model implicitly serialized object lifetimes through event queues; hci_sync exposes new race windows in abort paths that didn't exist before.
What matters for defenders: the refcount_hold() fix is trivially simple at the call site, but the pattern is not isolated. Recent commits show clustering of similar refcount_hold() insertions around abort and error paths in connection teardown — this is a systematic blind spot, not scattered bad luck. Audit any hci_sync code paths that handle connection teardown, abort flows, or error conditions. The connection object (hci_conn) anchors authentication state, key exchange sessions, and pairing credentials — a successful UAF here could enable MITM-style attacks, not just a crash.
The open question is whether the hci_sync conversion has a defined completion criteria for exhaustive reference-count auditing, or if the project is patching theoretical UAFs reactively as reviewers find them. Given the EPSS score of 0.00254, near-term exploitability is low, but the blast radius if triggered is significant. Prioritize auditing remaining hci_sync abort paths for similar patterns.