CVE-2026-74538
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In the Linux kernel, Bluetooth ISO function iso_connect_ind does not hold the socket lock when accessing the conn field, leading to a race condition and potential use-after-free. Additionally, conn may be NULL if the socket has changed state.
Risk Assessment
Missing lock can cause system crash or malfunction of the Bluetooth stack.
Recommendation
Apply the patch that adds lock_sock and rechecks hcon validity after acquiring the lock.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_connect_ind Accessing iso_pi(sk)->conn requires lock_sock, which is not taken in the "ev3" part of iso_connect_ind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before locking. Fix by adding lock/release. Recheck hcon is valid after lock acquire where needed.