CVE-2026-74534
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In the Linux kernel, in the Bluetooth ISO subsystem, a reference counting bug was found in the iso_conn structure. A race between iso_conn_del() and iso_chan_del() can lead to a double-put of iso_conn, resulting in use-after-free (UAF). The issue stems from an extra put in iso_conn_del() for the case when iso_chan_add() fails.
Risk Assessment
Double-free can lead to system crashes or memory corruption, which could be exploited by an attacker for privilege escalation or arbitrary code execution.
Recommendation
Apply the kernel patch that changes reference management so that iso_pi(sk)->conn owns a reference and iso_conn_del() does not perform an extra put. Update the system to a kernel version with the fix.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of iso_conn iso_conn_del() and iso_chan_del() have a race that results to double-put of iso_conn: [Task hdev->workqueue] [Task 2] iso_conn_del iso_chan_del iso_conn_hold_unless_zero iso_conn_lock iso_conn_lock conn->sk = NULL iso_conn_unlock sk = iso_sock_hold(conn) <---------´ if (!sk) iso_conn_put iso_conn_put iso_conn_put /* UAF */ The extra put for !sk in iso_conn_del() is currently required since failing iso_chan_add() may leave iso_conn not associated with any sk. Fix by having iso_pi(sk)->conn own refcount when non-NULL, so iso_conn_del does not need to put it. Adjust the iso_conn_add() refcounting so that conn is put if it does not get associated with an sk.