CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: hold sk properly in isoconnready
sk deref in isoconnready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either:
[Task 1] [Task 2] isosockrelease isoconnready sk = conn->sk locksock(sk) conn->sk = NULL locksock(sk) releasesock(sk) isosockkill(sk) UAF on sk deref
Fix possible UAF by holding sk refcount in isoconnready(). Also recheck after locksock that the socket is still valid. Adjust locking so conn->sk is cleared only under locksock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.44 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.8 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.8-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
In Linux Bluetooth ISO handling, fix iso_conn_ready() to hold a reference count on sk while using it, ensure conn->sk is cleared only under lock_sock, and recheck after lock_sock that the socket is still valid before dereferencing it.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74537?
CVE-2026-74537 has been assigned a risk score of 34, indicating a moderate severity vulnerability.
How do I fix CVE-2026-74537?
To fix CVE-2026-74537, update your Linux kernel to the latest version where the vulnerability has been resolved.
What systems are affected by CVE-2026-74537?
CVE-2026-74537 affects the Bluetooth subsystem in the Linux kernel.
What type of vulnerability is CVE-2026-74537?
CVE-2026-74537 is a concurrency issue related to accessing the socket structure without proper locking in the Bluetooth ISO connection.
When was CVE-2026-74537 published?
CVE-2026-74537 was published on August 15, 2026.