UBUNTU-CVE-2026-74535: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in isosocktimeout isosocktimeout() takes locksock, so sync disabling the timer while holding that lock may deadlock. isosocktimeout() may also run concurrently with isoconndel(), which leads to UAF [Task 1] [Task hdev->workqueue] isosocktimeout isoconndel isoconnholdunlesszero isochandel ------------> isoconnput caller frees hcon isoconnput isoconnfree conn->hcon->isodata = NULL; / UAF / Fix the deadlock by removing the disable from the locksock sections. Move the timer from isoconn to isopinfo to decouple it from isoconn which may need to be freed in locksock section. Convert some of the cleartimer to disabletimer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Bluetooth ISO socket timer handling, replace the affected clear_timer calls with disable_timer and remove timer disabling from lock_sock sections to avoid deadlocks; move the timer from iso_conn to iso_pinfo so it is decoupled from iso_conn lifetime.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vector is local and requires low privileges. Exploitation also has high attack complexity and depends on an additional precondition.
What runtime condition is involved in the vulnerability?
The issue involves the Bluetooth ISO socket timeout path running while an ISO connection is being deleted. This race can cause a deadlock or use-after-free condition.
Which Ubuntu kernel package families are identified?
The listed affected software includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.