---
id: CVE-2026-74541
title: 'Bluetooth: ISO: clear iso_data always when detaching conn from hcon'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: ISO: clear iso_data always when detaching conn from hcon

  When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is
  necessary, otherwise later iso_…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 <
    cc1d39946d62bc568551dfb81149724de1e91338
  - >-
    Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 <
    7b51a9c25e9698b64df9f2218f10eecf7dc7e2d0
  - >-
    Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 <
    63c0f396a18b767eb28e895eb95bbdce6c172c59
  - >-
    Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 <
    69a4a7b162b3db6ac337e3094cdee38f24d42ff7
  - >-
    Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 <
    d57e506f6a1e3929611340fae87c1e4823f4d85c
  - Linux c03a10bd5b6ccb22921e04bcddc987410df7e7a9
  - Linux >= 6.5.12 < 6.6
  - Linux 6.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:59:46.525127Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:54.748Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74541'
references:
  - url: 'https://git.kernel.org/stable/c/cc1d39946d62bc568551dfb81149724de1e91338'
  - url: 'https://git.kernel.org/stable/c/7b51a9c25e9698b64df9f2218f10eecf7dc7e2d0'
  - url: 'https://git.kernel.org/stable/c/63c0f396a18b767eb28e895eb95bbdce6c172c59'
  - url: 'https://git.kernel.org/stable/c/69a4a7b162b3db6ac337e3094cdee38f24d42ff7'
  - url: 'https://git.kernel.org/stable/c/d57e506f6a1e3929611340fae87c1e4823f4d85c'
tags:
  - cve.org
epss: 0.00247
epssPercentile: 0.14841
ingestedAt: '2026-10-16T19:46:24.346Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: clear iso_data always when detaching conn from hcon

When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is
necessary, otherwise later iso_conn_free() will UAF.

Fix clearing of iso_data in iso_sock_disconn()

Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on
iso_sock_release() followed by hci_abort_conn_sync().

## Affected

- `Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 < cc1d39946d62bc568551dfb81149724de1e91338`
- `Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 < 7b51a9c25e9698b64df9f2218f10eecf7dc7e2d0`
- `Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 < 63c0f396a18b767eb28e895eb95bbdce6c172c59`
- `Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 < 69a4a7b162b3db6ac337e3094cdee38f24d42ff7`
- `Linux >= fbdc4bc47268953c80853489f696e02d61f9a2c6 < d57e506f6a1e3929611340fae87c1e4823f4d85c`
- `Linux c03a10bd5b6ccb22921e04bcddc987410df7e7a9`
- `Linux >= 6.5.12 < 6.6`
- `Linux 6.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.