CVE-2026-74535: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: avoid deadlocks in isosocktimeout
isosocktimeout() takes locksock, so sync disabling the timer while holding that lock may deadlock.
isosocktimeout() may also run concurrently with isoconndel(), which leads to UAF
[Task 1] [Task hdev->workqueue] isosocktimeout isoconndel isoconnholdunlesszero isochandel ------------> isoconnput caller frees hcon isoconnput isoconnfree conn->hcon->isodata = NULL; / UAF /
Fix the deadlock by removing the disable from the locksock sections. Move the timer from isoconn to isopinfo to decouple it from isoconn which may need to be freed in locksock section. Convert some of the cleartimer to disabletimer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74535?
The severity of CVE-2026-74535 is rated as 48.
How do I fix CVE-2026-74535?
To fix CVE-2026-74535, update your Linux kernel to the latest patched version that resolves this vulnerability.
What systems are affected by CVE-2026-74535?
CVE-2026-74535 affects the Linux kernel implementation of Bluetooth ISO functionalities.
What kind of attack does CVE-2026-74535 prevent?
CVE-2026-74535 helps to prevent potential deadlock situations in Bluetooth ISO socket operations.
Is there a workaround for CVE-2026-74535?
There are no known workarounds for CVE-2026-74535; updating the kernel is the recommended solution.