CVE-2026-74537
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In the Linux kernel, Bluetooth ISO function iso_conn_ready does not properly hold a reference to the socket when accessing conn->sk, leading to a use-after-free if the socket is concurrently closed.
Risk Assessment
The vulnerability can cause system crash or potentially remote code execution by an attacker within Bluetooth range.
Recommendation
Apply the patch that holds a socket reference in iso_conn_ready and rechecks socket validity after locking.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in iso_conn_ready sk deref in iso_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either: [Task 1] [Task 2] iso_sock_release iso_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) iso_sock_kill(sk) UAF on sk deref Fix possible UAF by holding sk refcount in iso_conn_ready(). Also recheck after lock_sock that the socket is still valid. Adjust locking so conn->sk is cleared only under lock_sock.