CVE-2026-74533: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: fix race of kfree vs krefgetunlesszero
hciconn::isodata is accessed and modified without lock or RCU. This leads to a race
[Task hdev->workqueue] [Task 2] isorecv isoconnput(conn) conn = LOAD hcon->isodata isoconnfree(conn) isoconnholdunlesszero(conn) hcon->isodata = NULL kfree(conn) krefgetunlesszero(&conn->ref) / UAF /
and also to races in isoconnadd() vs. isoconnfree().
Fix by adding spinlock hciconn::protolock and using it to guard hciconn::isodata.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Configuration
Add hci_conn::proto_lock and use it to guard all accesses and modifications to hci_conn::iso_data, including in iso_recv(), iso_conn_add(), and iso_conn_free().
Bluetooth ISO hci_conn proto_lock = spinlock
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74533?
The severity of CVE-2026-74533 is rated at 47.
How do I fix CVE-2026-74533?
To fix CVE-2026-74533, update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What kind of impact does CVE-2026-74533 have on the Linux kernel?
CVE-2026-74533 can lead to race conditions affecting Bluetooth ISO data handling in the Linux kernel.
Is CVE-2026-74533 specific to any version of the Linux kernel?
CVE-2026-74533 impacts specific versions of the Linux kernel that handle Bluetooth ISO connections.
What should I do if I cannot update my system to fix CVE-2026-74533?
If you cannot update, consider implementing security controls to limit exposure and monitor for unusual activity.