CVE-2026-74541
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In the Linux kernel, Bluetooth ISO has a use-after-free vulnerability when detaching a connection from hcon. Failure to clear iso_data leads to later use after memory free.
Risk Assessment
The vulnerability can cause system crash or potentially remote code execution by an attacker within Bluetooth range.
Recommendation
Apply the patch that clears iso_data whenever detaching a connection from hcon.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: clear iso_data always when detaching conn from hcon When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is necessary, otherwise later iso_conn_free() will UAF. Fix clearing of iso_data in iso_sock_disconn() Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on iso_sock_release() followed by hci_abort_conn_sync().