CVE-2026-74533

Received Received - Intake

Bluetooth Race Condition in Linux Kernel ISO Implementation

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race [Task hdev->workqueue] [Task 2] iso_recv iso_conn_put(conn) conn = LOAD hcon->iso_data iso_conn_free(conn) iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL kfree(conn) kref_get_unless_zero(&conn->ref) /* UAF */ and also to races in iso_conn_add() vs. iso_conn_free(). Fix by adding spinlock hci_conn::proto_lock and using it to guard hci_conn::iso_data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74533

EUVD

EUVD-2026-59726

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's Bluetooth ISO (isochronous) subsystem. It occurs due to a race condition where hci_conn::iso_data is accessed without proper locking, allowing a task to free memory while another task still holds a reference to it. The fix involves adding a spinlock to protect access to iso_data.

Detection Guidance

This vulnerability involves a race condition in the Linux kernel's Bluetooth ISO implementation. Detection requires checking kernel logs for Bluetooth-related errors or crashes, particularly involving hci_conn or iso_data. Monitor system logs with commands like dmesg | grep -i bluetooth or journalctl -k | grep -i bluetooth. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

This vulnerability could lead to system crashes, memory corruption, or privilege escalation if exploited. Attackers within Bluetooth range might trigger the race condition to cause denial-of-service or execute arbitrary code in the kernel context.

Compliance Impact

This vulnerability is a race condition in the Linux kernel's Bluetooth ISO data handling, leading to a use-after-free (UAF) issue. It does not directly affect compliance with GDPR, HIPAA, or other standards as it is a low-level kernel bug rather than a data protection or privacy issue.

Mitigation Strategies

Apply the Linux kernel patch that fixes the race condition in Bluetooth ISO handling. Update to a kernel version that includes the fix for CVE-2026-74533. If immediate patching is not possible, consider disabling Bluetooth functionality temporarily until the patch is applied.

Hi! I’m here to help you understand CVE-2026-74533. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70