High 8.8Published Aug 15, 2026

CVE-2026-74534Bluetooth: ISO: fix refcounting of iso_conn

Updated under an hour ago (2026-10-19 06:30 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of iso_conn iso_conn_del() and iso_chan_del() have a race that results to double-put of iso_conn: [Task hdev->workqueue] [Task 2] iso_conn_del iso_chan_del iso_conn_hold_unless_zero iso_conn_lock iso_conn_lock conn->sk = NULL iso_conn_unlock sk = iso_sock_hold(conn) <---------´ if (!sk) iso_conn_put iso_conn_put iso_conn_put /* UAF */ The extra put for !sk in iso_conn_del() is currently required since failing iso_chan_add() may leave iso_conn not associated with any sk. Fix by having iso_pi(sk)->conn own refcount when non-NULL, so iso_conn_del does not need to put it. Adjust the iso_conn_add() refcounting so that conn is put if it does not get associated with an sk.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from dc26097bdb864a0d5955b9a25e43376ffc1af99b before 3b921533e8aa95b77aadcf31737595578e735f3c; from dc26097bdb864a0d5955b9a25e43376ffc1af99b before 8208b4939afb0a1977fffe902c3ca42fe0f3baaa; from dc26097bdb864a0d5955b9a25e43376ffc1af99b before fdfde532ab1caa165fcd8985001157ac8b4db365; f53e7489273dc2bb307bf50f319b3762d45534f0; a58d0f5dac322e16cc75334d000666512341bde5; from 6.11.11 before 6.12; from 6.12.2 before 6.13	CNA record

References

https://git.kernel.org/stable/c/3b921533e8aa95b77aadcf31737595578e735f3c
https://git.kernel.org/stable/c/8208b4939afb0a1977fffe902c3ca42fe0f3baaa
https://git.kernel.org/stable/c/fdfde532ab1caa165fcd8985001157ac8b4db365

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.