CVE-2026-74533: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: fix race of kfree vs krefgetunlesszero
hciconn::isodata is accessed and modified without lock or RCU. This leads to a race
[Task hdev->workqueue] [Task 2] isorecv isoconnput(conn) conn = LOAD hcon->isodata isoconnfree(conn) isoconnholdunlesszero(conn) hcon->isodata = NULL kfree(conn) krefgetunlesszero(&conn->ref) / UAF /
and also to races in isoconnadd() vs. isoconnfree().
Fix by adding spinlock hciconn::protolock and using it to guard hciconn::isodata.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74533?
The severity of CVE-2026-74533 is rated at 47.
How do I fix CVE-2026-74533?
To fix CVE-2026-74533, update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What kind of impact does CVE-2026-74533 have on the Linux kernel?
CVE-2026-74533 can lead to race conditions affecting Bluetooth ISO data handling in the Linux kernel.
Is CVE-2026-74533 specific to any version of the Linux kernel?
CVE-2026-74533 impacts specific versions of the Linux kernel that handle Bluetooth ISO connections.
What should I do if I cannot update my system to fix CVE-2026-74533?
If you cannot update, consider implementing security controls to limit exposure and monitor for unusual activity.