{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74537", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.913Z", "datePublished": "2026-08-15T12:27:49.668Z", "dateUpdated": "2026-08-17T05:48:25.530Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:48:25.530Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: hold sk properly in iso_conn_ready\n\nsk deref in iso_conn_ready must be done either under conn->lock, or\nholding a refcount, to avoid concurrent close. conn->sk is currently\naccessed without either:\n\n [Task 1] [Task 2]\n iso_sock_release\n iso_conn_ready\n sk = conn->sk\n lock_sock(sk)\n conn->sk = NULL\n lock_sock(sk)\n release_sock(sk)\n iso_sock_kill(sk)\n UAF on sk deref\n\nFix possible UAF by holding sk refcount in iso_conn_ready(). Also\nrecheck after lock_sock that the socket is still valid. Adjust locking\nso conn->sk is cleared only under lock_sock."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The bug is in the Bluetooth ISO stack; iso_conn_ready runs from HCI connection-confirmation events (CIS/BIS/PA sync) driven by LE isochronous traffic from Bluetooth peers within radio range, which is an adjacent attack surface (phones, earbuds, automotive, embedded).\nAC:L - This is a use-after-free race between iso_conn_ready and iso_sock_release/iso_sock_kill; an attacker who controls both an ISO socket close and concurrent HCI completion (e.g., dual-thread connect/close or rapid adjacent CIS/BIS establish-teardown) can reliably trigger it without uncontrollable conditions.\nPR:N - Exploitation requires no elevated credentials on the victim: HCI events are processed for any Bluetooth-enabled device in range, and the racing socket close can occur from automatic stack/daemon teardown during connection setup without the victim performing privileged local actions.\nUI:N - No victim interaction is required when the OS Bluetooth stack (e.g., LE Audio on Android phones or bluetoothd on Linux) automatically manages ISO sockets during pairing, reconnection, or broadcast sync while processing peer-initiated CIS/BIS traffic.\nS:U - The UAF corrupts kernel socket memory and can enable local privilege escalation within the kernel; it does not cross a VM, container, or IOMMU security boundary, so scope remains unchanged.\nC:H - Use-after-free on struct sock after iso_sock_kill frees the socket lets an attacker dereference attacker-influenced freed heap memory, enabling arbitrary kernel memory disclosure via heap grooming and reuse of the sock object.\nI:H - The UAF touches sk->sk_state and sk->sk_state_change during iso_sock_ready on a freed sock, providing a standard kernel heap corruption primitive that can be leveraged for arbitrary write and control-flow hijack.\nA:H - Concurrent iso_sock_kill and iso_conn_ready can dereference freed socket memory, causing kernel oops/panic from invalid lock_sock/sk_state access; UAF in the Bluetooth ISO path is inherently a high-availability risk even before full exploitation."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/iso.c"], "versions": [{"version": "27c24fda62b601d6f9ca5e992502578c4310876f", "lessThan": "4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5", "status": "affected", "versionType": "git"}, {"version": "27c24fda62b601d6f9ca5e992502578c4310876f", "lessThan": "1308d72903d792d10b82bc4ef08b8a4452308b04", "status": "affected", "versionType": "git"}, {"version": "27c24fda62b601d6f9ca5e992502578c4310876f", "lessThan": "0d255e63fcf3f13a570d7ac11678fa1164ac015c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/iso.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5"}, {"url": "https://git.kernel.org/stable/c/1308d72903d792d10b82bc4ef08b8a4452308b04"}, {"url": "https://git.kernel.org/stable/c/0d255e63fcf3f13a570d7ac11678fa1164ac015c"}], "title": "Bluetooth: ISO: hold sk properly in iso_conn_ready", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/iso.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5", "status": "affected", "version": "27c24fda62b601d6f9ca5e992502578c4310876f", "versionType": "git"}, {"lessThan": "1308d72903d792d10b82bc4ef08b8a4452308b04", "status": "affected", "version": "27c24fda62b601d6f9ca5e992502578c4310876f", "versionType": "git"}, {"lessThan": "0d255e63fcf3f13a570d7ac11678fa1164ac015c", "status": "affected", "version": "27c24fda62b601d6f9ca5e992502578c4310876f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/iso.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: hold sk properly in iso_conn_ready\n\nsk deref in iso_conn_ready must be done either under conn->lock, or\nholding a refcount, to avoid concurrent close. conn->sk is currently\naccessed without either:\n\n [Task 1] [Task 2]\n iso_sock_release\n iso_conn_ready\n sk = conn->sk\n lock_sock(sk)\n conn->sk = NULL\n lock_sock(sk)\n release_sock(sk)\n iso_sock_kill(sk)\n UAF on sk deref\n\nFix possible UAF by holding sk refcount in iso_conn_ready(). Also\nrecheck after lock_sock that the socket is still valid. Adjust locking\nso conn->sk is cleared only under lock_sock."}], "id": "CVE-2026-74537", "lastModified": "2026-08-17T06:19:50.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T13:17:59.040", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0d255e63fcf3f13a570d7ac11678fa1164ac015c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1308d72903d792d10b82bc4ef08b8a4452308b04"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Bluetooth: ISO: hold sk properly in iso_conn_ready", "id": "2517016", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517016"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: ISO: hold sk properly in iso_conn_ready\nsk deref in iso_conn_ready must be done either under conn->lock, or\nholding a refcount, to avoid concurrent close. conn->sk is currently\naccessed without either:\n[Task 1] [Task 2]\niso_sock_release\niso_conn_ready\nsk = conn->sk\nlock_sock(sk)\nconn->sk = NULL\nlock_sock(sk)\nrelease_sock(sk)\niso_sock_kill(sk)\nUAF on sk deref\nFix possible UAF by holding sk refcount in iso_conn_ready(). Also\nrecheck after lock_sock that the socket is still valid. Adjust locking\nso conn->sk is cleared only under lock_sock.", "A flaw was found in the Linux kernel's Bluetooth ISO subsystem. A race condition in the `iso_conn_ready` function allows a socket to be prematurely freed while still in use. This Use-After-Free (UAF) vulnerability could lead to memory corruption, potentially causing a system crash or other unpredictable behavior."], "name": "CVE-2026-74537", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74537\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74537\nhttps://lore.kernel.org/linux-cve-announce/2026081548-CVE-2026-74537-7d32@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[27c24fda62b601d6f9ca5e992502578c4310876f,4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[27c24fda62b601d6f9ca5e992502578c4310876f,1308d72903d792d10b82bc4ef08b8a4452308b04)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[27c24fda62b601d6f9ca5e992502578c4310876f,0d255e63fcf3f13a570d7ac11678fa1164ac015c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc6,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T15:15:03.212954+00:00", "updated": "2026-08-21T23:30:17.180530+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}