CVE-2026-74537
Received Received - Intake

Bluetooth Use-After-Free in Linux Kernel ISO

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in iso_conn_ready sk deref in iso_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either: [Task 1] [Task 2] iso_sock_release iso_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) iso_sock_kill(sk) UAF on sk deref Fix possible UAF by holding sk refcount in iso_conn_ready(). Also recheck after lock_sock that the socket is still valid. Adjust locking so conn->sk is cleared only under lock_sock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74537
EUVD
EUVD-2026-59730

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's Bluetooth ISO (isochronous) connection handling. The issue occurs in the iso_conn_ready function where the socket (sk) is accessed without proper synchronization. A race condition can happen between two tasks: one accessing conn->sk in iso_conn_ready while another concurrently closes the socket in iso_sock_release, leading to a UAF when the socket is dereferenced.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth ISO implementation and may not have direct network detection commands. Monitor kernel logs for Bluetooth-related crashes or use kernel tracing tools like ftrace or perf to detect unusual socket behavior. Check for kernel oops or panic messages related to Bluetooth ISO.

Impact Analysis

An attacker within Bluetooth range could exploit this to cause a denial-of-service (system crash) or potentially execute arbitrary code with kernel privileges. This requires proximity to the vulnerable system and may not be exploitable remotely.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, disable Bluetooth ISO functionality by unloading the related kernel modules (e.g., bluetooth, btiso) or restrict Bluetooth usage until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74537. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart