CVE-2026-74538 is a vulnerability in Linux Kernel
Published on August 15, 2026
Bluetooth: ISO: lock sk in iso_connect_ind
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: lock sk in iso_connect_ind
Accessing iso_pi(sk)->conn requires lock_sock, which is not taken in the
"ev3" part of iso_connect_ind. It may also be NULL if socket has
transitioned away from the LISTEN/CONNECT states before locking.
Fix by adding lock/release. Recheck hcon is valid after lock acquire
where needed.
Products Associated with CVE-2026-74538
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb and below e8e9cff6d80eeec28dec4cf7cc18662986945391 is affected.
- Version 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb and below 9bee7e476534f27e830658dad962d85da9edf6bf is affected.
- Version 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb and below 4311fd6f429065a8ba208660360a895627a00cf3 is affected.
- Version 489efc9ae36f164423f5fa7ace772a7ab8131cd8 is affected.
- Version 6.8.9 and below 6.9 is affected.
- Version 6.9 is affected.
- Before 6.9 is unaffected.
- Version 6.18.44, <= 6.18.* is unaffected.
- Version 7.1.8, <= 7.1.* is unaffected.
- Version 7.2-rc6, <= * is unaffected.