CVE-2026-74538

Summary

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: lock sk in iso_connect_ind

Accessing iso_pi(sk)->conn requires lock_sock, which is not taken in the "ev3" part of iso_connect_ind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before locking.

Fix by adding lock/release. Recheck hcon is valid after lock acquire where needed.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux168d9bf9c7f01df71e6404cfff66d9c2a8e968fb < e8e9cff6d80eeec28dec4cf7cc18662986945391affected
LinuxLinux168d9bf9c7f01df71e6404cfff66d9c2a8e968fb < 9bee7e476534f27e830658dad962d85da9edf6bfaffected
LinuxLinux168d9bf9c7f01df71e6404cfff66d9c2a8e968fb < 4311fd6f429065a8ba208660360a895627a00cf3affected
LinuxLinux489efc9ae36f164423f5fa7ace772a7ab8131cd8affected
LinuxLinux6.8.9 < 6.9affected
LinuxLinux6.9affected
LinuxLinux0 < 6.9unaffected
LinuxLinux6.18.44 <= 6.18.*unaffected
LinuxLinux7.1.8 <= 7.1.*unaffected
LinuxLinux7.2-rc6 <= *unaffected

Weaknesses

References