{"id":"CVE-2026-74534","title":"Bluetooth: ISO: fix refcounting of iso_conn","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix refcounting of iso_conn\n\niso_conn_del() and iso_chan_del() have a race that results to double-put\nof iso_conn:\n\n    [Task hdev->workqueue]         […","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= dc26097bdb864a0d5955b9a25e43376ffc1af99b < 3b921533e8aa95b77aadcf31737595578e735f3c","Linux >= dc26097bdb864a0d5955b9a25e43376ffc1af99b < 8208b4939afb0a1977fffe902c3ca42fe0f3baaa","Linux >= dc26097bdb864a0d5955b9a25e43376ffc1af99b < fdfde532ab1caa165fcd8985001157ac8b4db365","Linux f53e7489273dc2bb307bf50f319b3762d45534f0","Linux a58d0f5dac322e16cc75334d000666512341bde5","Linux >= 6.11.11 < 6.12","Linux >= 6.12.2 < 6.13","Linux 6.13"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:59:26.294931Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:05:53.833Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74534","references":[{"url":"https://git.kernel.org/stable/c/3b921533e8aa95b77aadcf31737595578e735f3c"},{"url":"https://git.kernel.org/stable/c/8208b4939afb0a1977fffe902c3ca42fe0f3baaa"},{"url":"https://git.kernel.org/stable/c/fdfde532ab1caa165fcd8985001157ac8b4db365"}],"tags":["cve.org"],"epss":0.00375,"epssPercentile":0.29913,"ingestedAt":"2026-10-16T19:46:24.347Z","slug":"CVE-2026-74534","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix refcounting of iso_conn\n\niso_conn_del() and iso_chan_del() have a race that results to double-put\nof iso_conn:\n\n    [Task hdev->workqueue]         [Task 2]\n    iso_conn_del                   iso_chan_del\n      iso_conn_hold_unless_zero      iso_conn_lock\n      iso_conn_lock                  conn->sk = NULL\n                                     iso_conn_unlock\n      sk = iso_sock_hold(conn)  <---------´\n      if (!sk) iso_conn_put          iso_conn_put\n      iso_conn_put /* UAF */\n\nThe extra put for !sk in iso_conn_del() is currently required since\nfailing iso_chan_add() may leave iso_conn not associated with any sk.\n\nFix by having iso_pi(sk)->conn own refcount when non-NULL, so\niso_conn_del does not need to put it.  Adjust the iso_conn_add()\nrefcounting so that conn is put if it does not get associated with an\nsk.\n\n## Affected\n\n- `Linux >= dc26097bdb864a0d5955b9a25e43376ffc1af99b < 3b921533e8aa95b77aadcf31737595578e735f3c`\n- `Linux >= dc26097bdb864a0d5955b9a25e43376ffc1af99b < 8208b4939afb0a1977fffe902c3ca42fe0f3baaa`\n- `Linux >= dc26097bdb864a0d5955b9a25e43376ffc1af99b < fdfde532ab1caa165fcd8985001157ac8b4db365`\n- `Linux f53e7489273dc2bb307bf50f319b3762d45534f0`\n- `Linux a58d0f5dac322e16cc75334d000666512341bde5`\n- `Linux >= 6.11.11 < 6.12`\n- `Linux >= 6.12.2 < 6.13`\n- `Linux 6.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}