---
id: CVE-2026-74537
title: 'Bluetooth: ISO: hold sk properly in iso_conn_ready'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: ISO: hold sk properly in iso_conn_ready

  sk deref in iso_conn_ready must be done either under conn->lock, or
  holding a refcount, to avoid concurrent close. c…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 27c24fda62b601d6f9ca5e992502578c4310876f <
    4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5
  - >-
    Linux >= 27c24fda62b601d6f9ca5e992502578c4310876f <
    1308d72903d792d10b82bc4ef08b8a4452308b04
  - >-
    Linux >= 27c24fda62b601d6f9ca5e992502578c4310876f <
    0d255e63fcf3f13a570d7ac11678fa1164ac015c
  - Linux 5.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:59:33.051138Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:54.154Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74537'
references:
  - url: 'https://git.kernel.org/stable/c/4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5'
  - url: 'https://git.kernel.org/stable/c/1308d72903d792d10b82bc4ef08b8a4452308b04'
  - url: 'https://git.kernel.org/stable/c/0d255e63fcf3f13a570d7ac11678fa1164ac015c'
tags:
  - cve.org
epss: 0.00239
epssPercentile: 0.13915
ingestedAt: '2026-10-16T19:46:24.347Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: hold sk properly in iso_conn_ready

sk deref in iso_conn_ready must be done either under conn->lock, or
holding a refcount, to avoid concurrent close. conn->sk is currently
accessed without either:

    [Task 1]            [Task 2]
                        iso_sock_release
    iso_conn_ready
      sk = conn->sk
                          lock_sock(sk)
                            conn->sk = NULL
      lock_sock(sk)
                          release_sock(sk)
                          iso_sock_kill(sk)
       UAF on sk deref

Fix possible UAF by holding sk refcount in iso_conn_ready().  Also
recheck after lock_sock that the socket is still valid.  Adjust locking
so conn->sk is cleared only under lock_sock.

## Affected

- `Linux >= 27c24fda62b601d6f9ca5e992502578c4310876f < 4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5`
- `Linux >= 27c24fda62b601d6f9ca5e992502578c4310876f < 1308d72903d792d10b82bc4ef08b8a4452308b04`
- `Linux >= 27c24fda62b601d6f9ca5e992502578c4310876f < 0d255e63fcf3f13a570d7ac11678fa1164ac015c`
- `Linux 5.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.