CVE-2026-74537

Summary

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: hold sk properly in iso_conn_ready

sk deref in iso_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either:

[Task 1]            [Task 2]
                    iso_sock_release
iso_conn_ready
  sk = conn->sk
                      lock_sock(sk)
                        conn->sk = NULL
  lock_sock(sk)
                      release_sock(sk)
                      iso_sock_kill(sk)
   UAF on sk deref

Fix possible UAF by holding sk refcount in iso_conn_ready(). Also recheck after lock_sock that the socket is still valid. Adjust locking so conn->sk is cleared only under lock_sock.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux27c24fda62b601d6f9ca5e992502578c4310876f < 4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5affected
LinuxLinux27c24fda62b601d6f9ca5e992502578c4310876f < 1308d72903d792d10b82bc4ef08b8a4452308b04affected
LinuxLinux27c24fda62b601d6f9ca5e992502578c4310876f < 0d255e63fcf3f13a570d7ac11678fa1164ac015caffected
LinuxLinux5.15affected
LinuxLinux0 < 5.15unaffected
LinuxLinux6.18.44 <= 6.18.*unaffected
LinuxLinux7.1.8 <= 7.1.*unaffected
LinuxLinux7.2-rc6 <= *unaffected

Weaknesses

References