UBUNTU-CVE-2026-74536: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release isosockkill() tests !sockflag(sk, SOCKZAPPED) || sk->sksocket || sockflag(sk, SOCKDEAD) for early return, but this is always true since sockorphan(sk) sets SOCKDEAD, so the sk reference released by socket always leaks, isosockdestruct is never called. The socket reference also leaks when isosockclose() does not set SOCKZAPPED, since isoconndel() does not call isosockkill() after zapping. Fix by replacing SOCKDEAD by BTSKKILLED flag that is not used for something else, and locksock to ensure isosockkill() puts sk only after socket release only once. Release and isoconndel may run concurrently. Call isosockkill() from isoconndel() to clean sk up after zapping. Remove call to isosockkill() from isosockclose(), as it's generally no-op there.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Update the Bluetooth ISO socket lifecycle code: call iso_sock_kill() from iso_conn_del() after socket zapping; replace SOCK_DEAD with the dedicated BT_SK_KILLED flag; use lock_sock so iso_sock_kill() puts the socket only after socket release and only once; and remove the iso_sock_kill() call from iso_sock_close().