CVE-2026-74535
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout iso_sock_timeout() takes lock_sock, so sync disabling the timer while holding that lock may deadlock. iso_sock_timeout() may also run concurrently with iso_conn_del(), which leads to UAF [Task 1] [Task hdev->workqueue] iso_sock_timeout iso_conn_del iso_conn_hold_unless_zero iso_chan_del `------------> iso_conn_put caller frees hcon iso_conn_put iso_conn_free conn->hcon->iso_data = NULL; /* UAF */ Fix the deadlock by removing the disable from the lock_sock sections. Move the timer from iso_conn to iso_pinfo to decouple it from iso_conn which may need to be freed in lock_sock section. Convert some of the clear_timer to disable_timer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74535
EUVD
EUVD-2026-59728

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel Bluetooth vulnerability where a deadlock can occur in iso_sock_timeout() due to holding lock_sock while disabling a timer. Additionally, concurrent execution with iso_conn_del() may lead to a use-after-free (UAF) issue when iso_conn_put() frees memory that iso_sock_timeout() still references.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth ISO socket implementation and does not have direct network or system detection commands. It requires kernel-level inspection for signs of deadlocks or UAF in Bluetooth ISO socket operations. Monitor kernel logs for Bluetooth-related crashes or hangs.

Impact Analysis

This vulnerability could cause system instability, crashes, or potential privilege escalation if exploited. It specifically affects Bluetooth ISO socket operations in the Linux kernel, potentially disrupting Bluetooth functionality or enabling denial-of-service conditions.

Mitigation Strategies

Apply the kernel patch that resolves the deadlock and UAF issues in Bluetooth ISO sockets. Update to a Linux kernel version that includes the fix. Restart affected systems to ensure the patched kernel is active.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74535. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart