CVE-2026-74537 is a vulnerability in Linux Kernel
Published on August 15, 2026
Bluetooth: ISO: hold sk properly in iso_conn_ready
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: hold sk properly in iso_conn_ready
sk deref in iso_conn_ready must be done either under conn->lock, or
holding a refcount, to avoid concurrent close. conn->sk is currently
accessed without either:
[Task 1] [Task 2]
iso_sock_release
iso_conn_ready
sk = conn->sk
lock_sock(sk)
conn->sk = NULL
lock_sock(sk)
release_sock(sk)
iso_sock_kill(sk)
UAF on sk deref
Fix possible UAF by holding sk refcount in iso_conn_ready(). Also
recheck after lock_sock that the socket is still valid. Adjust locking
so conn->sk is cleared only under lock_sock.
Products Associated with CVE-2026-74537
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 27c24fda62b601d6f9ca5e992502578c4310876f and below 4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5 is affected.
- Version 27c24fda62b601d6f9ca5e992502578c4310876f and below 1308d72903d792d10b82bc4ef08b8a4452308b04 is affected.
- Version 27c24fda62b601d6f9ca5e992502578c4310876f and below 0d255e63fcf3f13a570d7ac11678fa1164ac015c is affected.
- Version 5.15 is affected.
- Before 5.15 is unaffected.
- Version 6.18.44, <= 6.18.* is unaffected.
- Version 7.1.8, <= 7.1.* is unaffected.
- Version 7.2-rc6, <= * is unaffected.