CVE-2026-74537
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in iso_conn_ready sk deref in iso_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either: [Task 1] [Task 2] iso_sock_release iso_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) iso_sock_kill(sk) UAF on sk deref Fix possible UAF by holding sk refcount in iso_conn_ready(). Also recheck after lock_sock that the socket is still valid. Adjust locking so conn->sk is cleared only under lock_sock.
How to fix
- Linux Linux622180fe44fb52d4d7bafcd67922959823fec263, 44590dc53c9e949d2fed399a571a89c3d7d0b245, 99b65f0ea3370c13687ff870330c425b6ca44e89, 4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5, 1308d72903d792d10b82bc4ef08b8a4452308b04, 0d255e63fcf3f13a570d7ac11678fa1164ac015c or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 27c24fda62b601d6f9ca5e992502578c4310876f ≤ v < 622180fe44fb52d4d7bafcd67922959823fec263, 27c24fda62b601d6f9ca5e992502578c4310876f ≤ v < 44590dc53c9e949d2fed399a571a89c3d7d0b245, 27c24fda62b601d6f9ca5e992502578c4310876f ≤ v < 99b65f0ea3370c13687ff870330c425b6ca44e89, 27c24fda62b601d6f9ca5e992502578c4310876f ≤ v < 4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5, 27c24fda62b601d6f9ca5e992502578c4310876f ≤ v < 1308d72903d792d10b82bc4ef08b8a4452308b04, 27c24fda62b601d6f9ca5e992502578c4310876f ≤ v < 0d255e63fcf3f13a570d7ac11678fa1164ac015c, 5.15 | 622180fe44fb52d4d7bafcd67922959823fec263, 44590dc53c9e949d2fed399a571a89c3d7d0b245, 99b65f0ea3370c13687ff870330c425b6ca44e89, 4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5, 1308d72903d792d10b82bc4ef08b8a4452308b04, 0d255e63fcf3f13a570d7ac11678fa1164ac015c |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.