CVE-2026-74534: Bluetooth: ISO: fix refcounting of iso_conn
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: fix refcounting of isoconn
isoconndel() and isochandel() have a race that results to double-put of isoconn:
[Task hdev->workqueue] [Task 2] isoconndel isochandel isoconnholdunlesszero isoconnlock isoconnlock conn->sk = NULL isoconnunlock sk = isosockhold(conn) <---------´ if (!sk) isoconnput isoconnput isoconnput / UAF /
The extra put for !sk in isoconndel() is currently required since failing isochanadd() may leave isoconn not associated with any sk.
Fix by having isopi(sk)->conn own refcount when non-NULL, so isoconndel does not need to put it. Adjust the isoconnadd() refcounting so that conn is put if it does not get associated with an sk.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74534?
CVE-2026-74534 has a severity score of 44, indicating a significant risk to affected systems.
How do I fix CVE-2026-74534?
To fix CVE-2026-74534, update your Linux kernel to the latest version where the vulnerability has been resolved.
What systems are affected by CVE-2026-74534?
CVE-2026-74534 affects versions of the Linux kernel that contain the Bluetooth ISO connection handling code.
What is the impact of CVE-2026-74534?
The impact of CVE-2026-74534 includes potential instability or crashes due to race conditions affecting Bluetooth ISO connections.
How can I determine if my system is vulnerable to CVE-2026-74534?
You can determine if your system is vulnerable to CVE-2026-74534 by checking your Linux kernel version against the patched versions.