{"id":"CVE-2026-74541","title":"Bluetooth: ISO: clear iso_data always when detaching conn from hcon","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: clear iso_data always when detaching conn from hcon\n\nWhen setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is\nnecessary, otherwise later iso_…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 < cc1d39946d62bc568551dfb81149724de1e91338","Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 < 7b51a9c25e9698b64df9f2218f10eecf7dc7e2d0","Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 < 63c0f396a18b767eb28e895eb95bbdce6c172c59","Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 < 69a4a7b162b3db6ac337e3094cdee38f24d42ff7","Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 < d57e506f6a1e3929611340fae87c1e4823f4d85c","Linux c03a10bd5b6ccb22921e04bcddc987410df7e7a9","Linux >= 6.5.12 < 6.6","Linux 6.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:59:46.525127Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:05:54.748Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74541","references":[{"url":"https://git.kernel.org/stable/c/cc1d39946d62bc568551dfb81149724de1e91338"},{"url":"https://git.kernel.org/stable/c/7b51a9c25e9698b64df9f2218f10eecf7dc7e2d0"},{"url":"https://git.kernel.org/stable/c/63c0f396a18b767eb28e895eb95bbdce6c172c59"},{"url":"https://git.kernel.org/stable/c/69a4a7b162b3db6ac337e3094cdee38f24d42ff7"},{"url":"https://git.kernel.org/stable/c/d57e506f6a1e3929611340fae87c1e4823f4d85c"}],"tags":["cve.org"],"epss":0.00247,"epssPercentile":0.14841,"ingestedAt":"2026-10-16T19:46:24.346Z","slug":"CVE-2026-74541","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: clear iso_data always when detaching conn from hcon\n\nWhen setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is\nnecessary, otherwise later iso_conn_free() will UAF.\n\nFix clearing of iso_data in iso_sock_disconn()\n\nFixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on\niso_sock_release() followed by hci_abort_conn_sync().\n\n## Affected\n\n- `Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 < cc1d39946d62bc568551dfb81149724de1e91338`\n- `Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 < 7b51a9c25e9698b64df9f2218f10eecf7dc7e2d0`\n- `Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 < 63c0f396a18b767eb28e895eb95bbdce6c172c59`\n- `Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 < 69a4a7b162b3db6ac337e3094cdee38f24d42ff7`\n- `Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 < d57e506f6a1e3929611340fae87c1e4823f4d85c`\n- `Linux c03a10bd5b6ccb22921e04bcddc987410df7e7a9`\n- `Linux >= 6.5.12 < 6.6`\n- `Linux 6.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}