CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: hold sk properly in isoconnready
sk deref in isoconnready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either:
[Task 1] [Task 2] isosockrelease isoconnready sk = conn->sk locksock(sk) conn->sk = NULL locksock(sk) releasesock(sk) isosockkill(sk) UAF on sk deref
Fix possible UAF by holding sk refcount in isoconnready(). Also recheck after locksock that the socket is still valid. Adjust locking so conn->sk is cleared only under locksock.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74537?
CVE-2026-74537 has been assigned a risk score of 34, indicating a moderate severity vulnerability.
How do I fix CVE-2026-74537?
To fix CVE-2026-74537, update your Linux kernel to the latest version where the vulnerability has been resolved.
What systems are affected by CVE-2026-74537?
CVE-2026-74537 affects the Bluetooth subsystem in the Linux kernel.
What type of vulnerability is CVE-2026-74537?
CVE-2026-74537 is a concurrency issue related to accessing the socket structure without proper locking in the Bluetooth ISO connection.
When was CVE-2026-74537 published?
CVE-2026-74537 was published on August 15, 2026.