{"id":"CVE-2026-74538","title":"Bluetooth: ISO: lock sk in iso_connect_ind","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: lock sk in iso_connect_ind\n\nAccessing iso_pi(sk)->conn requires lock_sock, which is not taken in the\n\"ev3\" part of iso_connect_ind.  It may also be NULL…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb < e8e9cff6d80eeec28dec4cf7cc18662986945391","Linux >= 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb < 9bee7e476534f27e830658dad962d85da9edf6bf","Linux >= 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb < 4311fd6f429065a8ba208660360a895627a00cf3","Linux 489efc9ae36f164423f5fa7ace772a7ab8131cd8","Linux >= 6.8.9 < 6.9","Linux 6.9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:59:35.716308Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:05:54.312Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74538","references":[{"url":"https://git.kernel.org/stable/c/e8e9cff6d80eeec28dec4cf7cc18662986945391"},{"url":"https://git.kernel.org/stable/c/9bee7e476534f27e830658dad962d85da9edf6bf"},{"url":"https://git.kernel.org/stable/c/4311fd6f429065a8ba208660360a895627a00cf3"}],"tags":["cve.org"],"epss":0.00375,"epssPercentile":0.29896,"ingestedAt":"2026-10-16T19:46:24.346Z","slug":"CVE-2026-74538","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: lock sk in iso_connect_ind\n\nAccessing iso_pi(sk)->conn requires lock_sock, which is not taken in the\n\"ev3\" part of iso_connect_ind.  It may also be NULL if socket has\ntransitioned away from the LISTEN/CONNECT states before locking.\n\nFix by adding lock/release. Recheck hcon is valid after lock acquire\nwhere needed.\n\n## Affected\n\n- `Linux >= 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb < e8e9cff6d80eeec28dec4cf7cc18662986945391`\n- `Linux >= 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb < 9bee7e476534f27e830658dad962d85da9edf6bf`\n- `Linux >= 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb < 4311fd6f429065a8ba208660360a895627a00cf3`\n- `Linux 489efc9ae36f164423f5fa7ace772a7ab8131cd8`\n- `Linux >= 6.8.9 < 6.9`\n- `Linux 6.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}