---
id: CVE-2026-74538
title: 'Bluetooth: ISO: lock sk in iso_connect_ind'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: ISO: lock sk in iso_connect_ind

  Accessing iso_pi(sk)->conn requires lock_sock, which is not taken in the
  "ev3" part of iso_connect_ind.  It may also be NULL…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb <
    e8e9cff6d80eeec28dec4cf7cc18662986945391
  - >-
    Linux >= 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb <
    9bee7e476534f27e830658dad962d85da9edf6bf
  - >-
    Linux >= 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb <
    4311fd6f429065a8ba208660360a895627a00cf3
  - Linux 489efc9ae36f164423f5fa7ace772a7ab8131cd8
  - Linux >= 6.8.9 < 6.9
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:59:35.716308Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:54.312Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74538'
references:
  - url: 'https://git.kernel.org/stable/c/e8e9cff6d80eeec28dec4cf7cc18662986945391'
  - url: 'https://git.kernel.org/stable/c/9bee7e476534f27e830658dad962d85da9edf6bf'
  - url: 'https://git.kernel.org/stable/c/4311fd6f429065a8ba208660360a895627a00cf3'
tags:
  - cve.org
epss: 0.00375
epssPercentile: 0.29896
ingestedAt: '2026-10-16T19:46:24.346Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: lock sk in iso_connect_ind

Accessing iso_pi(sk)->conn requires lock_sock, which is not taken in the
"ev3" part of iso_connect_ind.  It may also be NULL if socket has
transitioned away from the LISTEN/CONNECT states before locking.

Fix by adding lock/release. Recheck hcon is valid after lock acquire
where needed.

## Affected

- `Linux >= 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb < e8e9cff6d80eeec28dec4cf7cc18662986945391`
- `Linux >= 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb < 9bee7e476534f27e830658dad962d85da9edf6bf`
- `Linux >= 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb < 4311fd6f429065a8ba208660360a895627a00cf3`
- `Linux 489efc9ae36f164423f5fa7ace772a7ab8131cd8`
- `Linux >= 6.8.9 < 6.9`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.