Bluetooth Vulnerability in Linux Kernel Affects Multiple Versions

CVE-2026-74534

What is CVE-2026-74534?

In the Linux kernel, a vulnerability related to Bluetooth has been identified, specifically impacting the handling of ISO connections. A race condition exists between the functions iso_conn_del() and iso_chan_del(), which could lead to a double put on iso_conn. When iso_chan_add() fails, the associated iso_conn may not link to any socket (sk), triggering an unintentional use-after-free (UAF) vulnerability. This issue has been addressed by restructuring the ownership of the reference count, ensuring that iso_conn_del() no longer requires an additional put operation. Proper adjustments have also been made to the refcounting mechanism in iso_conn_add() to resolve this potential risk.

References