CVE-2026-74539

Received Received - Intake

Bluetooth ISO Socket Name Information Disclosure

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_sock_getname Accessing iso_pi(sk)->conn requires lock_sock, which is not held here. Fix by adding the lock/release.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74539

EUVD

EUVD-2026-59732

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel Bluetooth vulnerability where the function iso_sock_getname accesses iso_pi(sk)->conn without holding the required lock_sock. This can lead to race conditions or memory corruption due to unsynchronized access to shared data.

Detection Guidance

This vulnerability involves a missing lock in the Linux kernel's Bluetooth ISO socket handling. Detection requires checking kernel logs for related errors or kernel crashes during Bluetooth operations. Commands like dmesg | grep -i bluetooth or journalctl -k | grep -i bluetooth may help identify issues.

Impact Analysis

An attacker within Bluetooth range could exploit this to cause a denial of service, crash the system, or potentially execute arbitrary code with kernel privileges. This affects systems using Bluetooth ISO sockets.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level Linux kernel Bluetooth issue. Compliance impacts would depend on how the vulnerability is exploited in a specific system or application context, which is not detailed here.

Mitigation Strategies

Apply the kernel patch that adds lock_sock and release_sock around iso_pi(sk)->conn access. Update to a fixed kernel version if available. If immediate patching is not possible, consider disabling Bluetooth functionality temporarily as a workaround.

Hi! I’m here to help you understand CVE-2026-74539. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70