CVE-2026-74533
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race [Task hdev->workqueue] [Task 2] iso_recv iso_conn_put(conn) conn = LOAD hcon->iso_data iso_conn_free(conn) iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL kfree(conn) kref_get_unless_zero(&conn->ref) /* UAF */ and also to races in iso_conn_add() vs. iso_conn_free(). Fix by adding spinlock hci_conn::proto_lock and using it to guard hci_conn::iso_data.
How to fix
- Linux Linux08ac98f18c8d24cc037858dd6fba2670155e4e84, 876a3e94c70d0859d1dad1c986112d4f0d99eba8, af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c, 6.12.114, 6.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | a58d0f5dac322e16cc75334d000666512341bde5 ≤ v < 08ac98f18c8d24cc037858dd6fba2670155e4e84, dc26097bdb864a0d5955b9a25e43376ffc1af99b ≤ v < 876a3e94c70d0859d1dad1c986112d4f0d99eba8, dc26097bdb864a0d5955b9a25e43376ffc1af99b ≤ v < af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c, f53e7489273dc2bb307bf50f319b3762d45534f0, 6.12.2 ≤ v < 6.12.114, 6.11.11 ≤ v < 6.12, 6.13 | 08ac98f18c8d24cc037858dd6fba2670155e4e84, 876a3e94c70d0859d1dad1c986112d4f0d99eba8, af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c, 6.12.114, 6.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.