GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74534 (GCVE-0-2026-74534)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-17 05:48
VLAI
Title
Bluetooth: ISO: fix refcounting of iso_conn
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of iso_conn iso_conn_del() and iso_chan_del() have a race that results to double-put of iso_conn: [Task hdev->workqueue] [Task 2] iso_conn_del iso_chan_del iso_conn_hold_unless_zero iso_conn_lock iso_conn_lock conn->sk = NULL iso_conn_unlock sk = iso_sock_hold(conn) <---------´ if (!sk) iso_conn_put iso_conn_put iso_conn_put /* UAF */ The extra put for !sk in iso_conn_del() is currently required since failing iso_chan_add() may leave iso_conn not associated with any sk. Fix by having iso_pi(sk)->conn own refcount when non-NULL, so iso_conn_del does not need to put it. Adjust the iso_conn_add() refcounting so that conn is put if it does not get associated with an sk.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: dc26097bdb864a0d5955b9a25e43376ffc1af99b , < 3b921533e8aa95b77aadcf31737595578e735f3c (git)
Affected: dc26097bdb864a0d5955b9a25e43376ffc1af99b , < 8208b4939afb0a1977fffe902c3ca42fe0f3baaa (git)
Affected: dc26097bdb864a0d5955b9a25e43376ffc1af99b , < fdfde532ab1caa165fcd8985001157ac8b4db365 (git)
Affected: f53e7489273dc2bb307bf50f319b3762d45534f0 (git)
Affected: a58d0f5dac322e16cc75334d000666512341bde5 (git)
Affected: 6.11.11 , < 6.12 (semver)
Affected: 6.12.2 , < 6.13 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3b921533e8aa95b77aadcf31737595578e735f3c",
              "status": "affected",
              "version": "dc26097bdb864a0d5955b9a25e43376ffc1af99b",
              "versionType": "git"
            },
            {
              "lessThan": "8208b4939afb0a1977fffe902c3ca42fe0f3baaa",
              "status": "affected",
              "version": "dc26097bdb864a0d5955b9a25e43376ffc1af99b",
              "versionType": "git"
            },
            {
              "lessThan": "fdfde532ab1caa165fcd8985001157ac8b4db365",
              "status": "affected",
              "version": "dc26097bdb864a0d5955b9a25e43376ffc1af99b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f53e7489273dc2bb307bf50f319b3762d45534f0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a58d0f5dac322e16cc75334d000666512341bde5",
              "versionType": "git"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThan": "6.13",
              "status": "affected",
              "version": "6.12.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.12.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix refcounting of iso_conn\n\niso_conn_del() and iso_chan_del() have a race that results to double-put\nof iso_conn:\n\n    [Task hdev-\u003eworkqueue]         [Task 2]\n    iso_conn_del                   iso_chan_del\n      iso_conn_hold_unless_zero      iso_conn_lock\n      iso_conn_lock                  conn-\u003esk = NULL\n                                     iso_conn_unlock\n      sk = iso_sock_hold(conn)  \u003c---------\u00b4\n      if (!sk) iso_conn_put          iso_conn_put\n      iso_conn_put /* UAF */\n\nThe extra put for !sk in iso_conn_del() is currently required since\nfailing iso_chan_add() may leave iso_conn not associated with any sk.\n\nFix by having iso_pi(sk)-\u003econn own refcount when non-NULL, so\niso_conn_del does not need to put it.  Adjust the iso_conn_add()\nrefcounting so that conn is put if it does not get associated with an\nsk."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in Bluetooth ISO connection teardown; a remote LE Audio/CIS/BIS peer in range can trigger iso_conn_del via HCI disconnect events (iso_disconn_cfm) that race with concurrent socket teardown.\nAC:L - The double kref_put race is between iso_conn_del and iso_chan_del; an adjacent attacker controls disconnect timing and can repeatedly connect/disconnect to race automatic kernel and Bluetooth daemon socket cleanup.\nPR:N - No local UNIX privileges are required; a malicious or compromised adjacent Bluetooth ISO peer with an established connection can initiate the disconnect leg without root, capabilities, or user-namespace admin rights.\nUI:N - No explicit victim action is needed beyond an active ISO session; remote disconnect triggers automatic HCI teardown and stack socket close that can race iso_chan_del without the user manually closing applications.\nS:U - The vulnerability corrupts kernel heap lifetime of iso_conn objects within the Bluetooth subsystem and does not cross VM, hypervisor, or IOMMU security boundaries.\nC:H - Premature kfree of iso_conn from the refcount race is a use-after-free that can expose kernel heap contents and be leveraged for arbitrary kernel memory disclosure.\nI:H - UAF on iso_conn enables heap grooming and corrupted pointer dereferences that can be leveraged for arbitrary kernel memory writes or privilege-escalating code execution.\nA:H - The double iso_conn_put can free iso_conn while still referenced, causing kernel oops/panic or reliably exploitable instability during ISO connection teardown."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:48:23.337Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3b921533e8aa95b77aadcf31737595578e735f3c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8208b4939afb0a1977fffe902c3ca42fe0f3baaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/fdfde532ab1caa165fcd8985001157ac8b4db365"
        }
      ],
      "title": "Bluetooth: ISO: fix refcounting of iso_conn",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74534",
    "datePublished": "2026-08-15T12:27:47.831Z",
    "dateReserved": "2026-08-15T05:44:03.913Z",
    "dateUpdated": "2026-08-17T05:48:23.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74534",
      "date": "2026-09-15",
      "epss": "0.00239",
      "percentile": "0.15062"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74534\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T13:17:58.700\",\"lastModified\":\"2026-08-17T06:19:50.400\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: ISO: fix refcounting of iso_conn\\n\\niso_conn_del() and iso_chan_del() have a race that results to double-put\\nof iso_conn:\\n\\n    [Task hdev-\u003eworkqueue]         [Task 2]\\n    iso_conn_del                   iso_chan_del\\n      iso_conn_hold_unless_zero      iso_conn_lock\\n      iso_conn_lock                  conn-\u003esk = NULL\\n                                     iso_conn_unlock\\n      sk = iso_sock_hold(conn)  \u003c---------\u00b4\\n      if (!sk) iso_conn_put          iso_conn_put\\n      iso_conn_put /* UAF */\\n\\nThe extra put for !sk in iso_conn_del() is currently required since\\nfailing iso_chan_add() may leave iso_conn not associated with any sk.\\n\\nFix by having iso_pi(sk)-\u003econn own refcount when non-NULL, so\\niso_conn_del does not need to put it.  Adjust the iso_conn_add()\\nrefcounting so that conn is put if it does not get associated with an\\nsk.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/iso.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"dc26097bdb864a0d5955b9a25e43376ffc1af99b\",\"lessThan\":\"3b921533e8aa95b77aadcf31737595578e735f3c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dc26097bdb864a0d5955b9a25e43376ffc1af99b\",\"lessThan\":\"8208b4939afb0a1977fffe902c3ca42fe0f3baaa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dc26097bdb864a0d5955b9a25e43376ffc1af99b\",\"lessThan\":\"fdfde532ab1caa165fcd8985001157ac8b4db365\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f53e7489273dc2bb307bf50f319b3762d45534f0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a58d0f5dac322e16cc75334d000666512341bde5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.11.11\",\"lessThan\":\"6.12\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.2\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/iso.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3b921533e8aa95b77aadcf31737595578e735f3c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8208b4939afb0a1977fffe902c3ca42fe0f3baaa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fdfde532ab1caa165fcd8985001157ac8b4db365\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-21T11:33:17+00:00",
      "cve": "CVE-2026-74534",
      "id": "CVE-2026-74534",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: ISO: fix refcounting of iso_conn",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74534.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.