Riskcovery

CVE-2026-74534

Bluetooth: ISO: fix refcounting of iso_conn

State
Published
Severity
8.8 High
Published
Aug 15, 2026
Updated
Oct 23, 2026
Reserved
Aug 15, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: fix refcounting of iso_conn

iso_conn_del() and iso_chan_del() have a race that results to double-put of iso_conn:

[Task hdev->workqueue] [Task 2] iso_conn_del iso_chan_del iso_conn_hold_unless_zero iso_conn_lock iso_conn_lock conn->sk = NULL iso_conn_unlock sk = iso_sock_hold(conn) <---------´ if (!sk) iso_conn_put iso_conn_put iso_conn_put /* UAF */

The extra put for !sk in iso_conn_del() is currently required since failing iso_chan_add() may leave iso_conn not associated with any sk.

Fix by having iso_pi(sk)->conn own refcount when non-NULL, so iso_conn_del does not need to put it. Adjust the iso_conn_add() refcounting so that conn is put if it does not get associated with an sk.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • a58d0f5dac322e16cc75334d000666512341bde5 to before 42c8bd6ac81e21200bb90f1eaf43d19352eec6d7Affected
  • dc26097bdb864a0d5955b9a25e43376ffc1af99b to before 3b921533e8aa95b77aadcf31737595578e735f3cAffected
  • dc26097bdb864a0d5955b9a25e43376ffc1af99b to before 8208b4939afb0a1977fffe902c3ca42fe0f3baaaAffected
  • dc26097bdb864a0d5955b9a25e43376ffc1af99b to before fdfde532ab1caa165fcd8985001157ac8b4db365Affected
  • f53e7489273dc2bb307bf50f319b3762d45534f0Affected
  • 6.12.2 to before 6.12.113Affected
  • 6.11.11 to before 6.12Affected
LinuxLinux
  • 6.13Affected
  • before 6.13Not affected
  • 6.12.113 through 6.12.*Not affected
  • 6.18.44 through 6.18.*Not affected
  • 7.1.8 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.