CVE-2026-74537

Bluetooth: ISO: hold sk properly in iso_conn_ready

State: Published
Severity: 8.8 High
Published: Aug 15, 2026
Updated: Oct 30, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: hold sk properly in iso_conn_ready

sk deref in iso_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either:

[Task 1] [Task 2] iso_sock_release iso_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) iso_sock_kill(sk) UAF on sk deref

Fix possible UAF by holding sk refcount in iso_conn_ready(). Also recheck after lock_sock that the socket is still valid. Adjust locking so conn->sk is cleared only under lock_sock.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	27c24fda62b601d6f9ca5e992502578c4310876f to before 622180fe44fb52d4d7bafcd67922959823fec263Affected 27c24fda62b601d6f9ca5e992502578c4310876f to before 44590dc53c9e949d2fed399a571a89c3d7d0b245Affected 27c24fda62b601d6f9ca5e992502578c4310876f to before 99b65f0ea3370c13687ff870330c425b6ca44e89Affected 27c24fda62b601d6f9ca5e992502578c4310876f to before 4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5Affected 27c24fda62b601d6f9ca5e992502578c4310876f to before 1308d72903d792d10b82bc4ef08b8a4452308b04Affected 27c24fda62b601d6f9ca5e992502578c4310876f to before 0d255e63fcf3f13a570d7ac11678fa1164ac015cAffected
LinuxLinux	5.15Affected before 5.15Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

27c24fda62b601d6f9ca5e992502578c4310876f to before 622180fe44fb52d4d7bafcd67922959823fec263Affected
27c24fda62b601d6f9ca5e992502578c4310876f to before 44590dc53c9e949d2fed399a571a89c3d7d0b245Affected
27c24fda62b601d6f9ca5e992502578c4310876f to before 99b65f0ea3370c13687ff870330c425b6ca44e89Affected
27c24fda62b601d6f9ca5e992502578c4310876f to before 4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5Affected
27c24fda62b601d6f9ca5e992502578c4310876f to before 1308d72903d792d10b82bc4ef08b8a4452308b04Affected
27c24fda62b601d6f9ca5e992502578c4310876f to before 0d255e63fcf3f13a570d7ac11678fa1164ac015cAffected

LinuxLinux

5.15Affected
before 5.15Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.