CVE-2026-74537 - Vulnerability Details

- Bluetooth: ISO: hold sk properly in iso_conn_ready

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: hold sk properly in iso_conn_ready

sk deref in iso_conn_ready must be done either under conn->lock, or
holding a refcount, to avoid concurrent close. conn->sk is currently
accessed without either:

[Task 1] [Task 2]
iso_sock_release
iso_conn_ready
sk = conn->sk
lock_sock(sk)
conn->sk = NULL
lock_sock(sk)
release_sock(sk)
iso_sock_kill(sk)
UAF on sk deref

Fix possible UAF by holding sk refcount in iso_conn_ready(). Also
recheck after lock_sock that the socket is still valid. Adjust locking
so conn->sk is cleared only under lock_sock.

Published: 2026-08-15

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s Bluetooth ISO stack contains a use‑after‑free flaw in the iso_conn_ready path. When a connection is ready, the code dereferences the socket reference (sk) without holding the connection lock or incrementing the socket’s reference counter. A concurrent call to iso_sock_release can clear the socket pointer and release the associated socket object while the dereference is still pending, leading to a use‑after‑free. This can cause kernel memory corruption or a crash.

Affected Systems

All Linux kernel builds that include the Bluetooth ISO layer and have not applied the patch commit are affected. This includes mainstream distributions and embedded systems running upstream kernels without the fix.

Risk and Exploitability

The CVSS score of 8.8 reflects a high severity UAF that can enable kernel crashes or memory corruption. No public exploits are known at present, and the vulnerability is not listed in CISA KEV. The EPSS score of < 1% indicates a very low probability of exploitation, but because the flaw operates in kernel space and can be triggered via Bluetooth ISO, systems with exposed Bluetooth services run a meaningful risk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`27c24fda62b601d6f9ca5e992502578c4310876f`	affected	< 4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5
`27c24fda62b601d6f9ca5e992502578c4310876f`	affected	< 1308d72903d792d10b82bc4ef08b8a4452308b04
`27c24fda62b601d6f9ca5e992502578c4310876f`	affected	< 0d255e63fcf3f13a570d7ac11678fa1164ac015c

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`6.18.44`	unaffected	≤ 6.18.*
`7.1.8`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[27c24fda62b601d6f9ca5e992502578c4310876f,4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5)`	affected	code_commit	—
`[27c24fda62b601d6f9ca5e992502578c4310876f,1308d72903d792d10b82bc4ef08b8a4452308b04)`	affected	code_commit	—
`[27c24fda62b601d6f9ca5e992502578c4310876f,0d255e63fcf3f13a570d7ac11678fa1164ac015c)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	generic	—
`[0,5.15)`	unaffected	semver	—
`[6.18.44,6.19.0)`	unaffected	semver	—
`[7.1.8,7.2.0)`	unaffected	semver	—
`[7.2-rc6,*)`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that contains the commit that correctly holds the socket reference in iso_conn_ready.
If a kernel upgrade cannot be performed immediately, disable the Bluetooth ISO subsystem (e.g., set CONFIG_BT_ISO=n or remove the iso modules) to stop iso_conn_ready from running.
Restrict or block unauthorized Bluetooth connections by disabling Bluetooth services or configuring firewall rules to reduce exposure to the ISO layer.

Generated by OpenCVE AI on August 21, 2026 at 23:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00239.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0d255e63fcf3f13a570d7ac11678fa1164ac015c
https://git.kernel.org/stable/c/1308d72903d792d10b82bc4ef08b8a4452308b04
https://git.kernel.org/stable/c/4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5
https://lore.kernel.org/linux-cve-announce/2026081548-CVE-2026-74537-7d32@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74537
https://www.cve.org/CVERecord?id=CVE-2026-74537

History

Fri, 21 Aug 2026 21:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Fri, 21 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026081548-CVE-2026-74537-7d32@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74537 https://www.cve.org/CVERecord?id=CVE-2026-74537
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 12:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in iso_conn_ready sk deref in iso_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either: [Task 1] [Task 2] iso_sock_release iso_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) iso_sock_kill(sk) UAF on sk deref Fix possible UAF by holding sk refcount in iso_conn_ready(). Also recheck after lock_sock that the socket is still valid. Adjust locking so conn->sk is cleared only under lock_sock.
Title		Bluetooth: ISO: hold sk properly in iso_conn_ready
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0d255e63fcf3f13a570d7ac11678fa1164ac015c https://git.kernel.org/stable/c/1308d72903d792d10b82bc4ef08b8a4452308b04 https://git.kernel.org/stable/c/4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T12:27:49.668Z

Updated: 2026-08-17T05:48:25.530Z

Reserved: 2026-08-15T05:44:03.913Z

Link: CVE-2026-74537

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T13:17:59.040

Modified: 2026-08-17T06:19:50.807

Link: CVE-2026-74537

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74537 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-21T23:30:17Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object