CVE-2026-74533

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the Bluetooth ISO implementation where hci conn::iso data is accessed and modified without a lock or Read-Copy-Update (RCU) mechanism. This flaw can lead to a Use-After-Free (UAF) scenario during the execution of iso recv and iso conn put, specifically when kref get unless zero() is called on a reference that has already been freed by kfree(). Additionally, race conditions occur between the iso conn add() and iso conn free() functions.

Recommendations Apply the update that introduces the hci conn::proto lock spinlock to guard hci conn::iso data.