CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: lock sk in isoconnectind
Accessing isopi(sk)->conn requires locksock, which is not taken in the "ev3" part of isoconnectind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before locking.
Fix by adding lock/release. Recheck hcon is valid after lock acquire where needed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74538?
The severity of CVE-2026-74538 is rated as 34.
What does CVE-2026-74538 affect?
CVE-2026-74538 affects the Bluetooth implementation in the Linux kernel.
How do I mitigate CVE-2026-74538?
Mitigation for CVE-2026-74538 involves updating to the patched version of the Linux kernel.
What potential risks are associated with CVE-2026-74538?
CVE-2026-74538 may lead to instability in Bluetooth connections and possible denial of service.
In which version of the Linux kernel was CVE-2026-74538 resolved?
CVE-2026-74538 was resolved in updates released on August 15, 2026.