CVE-2026-74541

Bluetooth: ISO: clear iso_data always when detaching conn from hcon

State: Published
Severity: 8.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: clear iso_data always when detaching conn from hcon

When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is necessary, otherwise later iso_conn_free() will UAF.

Fix clearing of iso_data in iso_sock_disconn()

Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on iso_sock_release() followed by hci_abort_conn_sync().

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	fbdc4bc47268953c80853489f696e02d61f9a2c6 to before cc1d39946d62bc568551dfb81149724de1e91338Affected fbdc4bc47268953c80853489f696e02d61f9a2c6 to before 7b51a9c25e9698b64df9f2218f10eecf7dc7e2d0Affected fbdc4bc47268953c80853489f696e02d61f9a2c6 to before 63c0f396a18b767eb28e895eb95bbdce6c172c59Affected fbdc4bc47268953c80853489f696e02d61f9a2c6 to before 69a4a7b162b3db6ac337e3094cdee38f24d42ff7Affected fbdc4bc47268953c80853489f696e02d61f9a2c6 to before d57e506f6a1e3929611340fae87c1e4823f4d85cAffected c03a10bd5b6ccb22921e04bcddc987410df7e7a9Affected 6.5.12 to before 6.6Affected
LinuxLinux	6.6Affected before 6.6Not affected 6.6.151 through 6.6.Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

fbdc4bc47268953c80853489f696e02d61f9a2c6 to before cc1d39946d62bc568551dfb81149724de1e91338Affected
fbdc4bc47268953c80853489f696e02d61f9a2c6 to before 7b51a9c25e9698b64df9f2218f10eecf7dc7e2d0Affected
fbdc4bc47268953c80853489f696e02d61f9a2c6 to before 63c0f396a18b767eb28e895eb95bbdce6c172c59Affected
fbdc4bc47268953c80853489f696e02d61f9a2c6 to before 69a4a7b162b3db6ac337e3094cdee38f24d42ff7Affected
fbdc4bc47268953c80853489f696e02d61f9a2c6 to before d57e506f6a1e3929611340fae87c1e4823f4d85cAffected
c03a10bd5b6ccb22921e04bcddc987410df7e7a9Affected
6.5.12 to before 6.6Affected

LinuxLinux

6.6Affected
before 6.6Not affected
6.6.151 through 6.6.*Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.