CVE-2026-74533 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race [Task hdev->workqueue] [Task 2] iso_recv iso_conn_put(conn) conn = LOAD hcon->iso_data iso_conn_free(conn) iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL kfree(conn) kref_get_unless_zero(&conn->ref) /* UAF */ and also to races in iso_conn_add() vs. iso_conn_free(). Fix by adding spinlock hci_conn::proto_lock and using it to guard hci_conn::iso_data.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/876a3e94c70d0859d1dad1c986112d4f0d99eba8
https://git.kernel.org/stable/c/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c

History

Sat, 15 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race [Task hdev->workqueue] [Task 2] iso_recv iso_conn_put(conn) conn = LOAD hcon->iso_data iso_conn_free(conn) iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL kfree(conn) kref_get_unless_zero(&conn->ref) /* UAF */ and also to races in iso_conn_add() vs. iso_conn_free(). Fix by adding spinlock hci_conn::proto_lock and using it to guard hci_conn::iso_data.
Title		Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/876a3e94c70d0859d1dad1c986112d4f0d99eba8 https://git.kernel.org/stable/c/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T12:27:47.219Z

Updated: 2026-08-15T12:27:47.219Z

Reserved: 2026-08-15T05:44:03.912Z

Link: CVE-2026-74533

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T13:17:58.603

Modified: 2026-08-15T13:17:58.603

Link: CVE-2026-74533

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74533", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.912Z", "datePublished": "2026-08-15T12:27:47.219Z", "dateUpdated": "2026-08-15T12:27:47.219Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-15T12:27:47.219Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix race of kfree vs kref_get_unless_zero\n\nhci_conn::iso_data is accessed and modified without lock or RCU.\nThis leads to a race\n\n [Task hdev->workqueue] \t[Task 2]\n iso_recv iso_conn_put(conn)\n conn = LOAD hcon->iso_data iso_conn_free(conn)\n iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL\n kfree(conn)\n kref_get_unless_zero(&conn->ref) /* UAF */\n\nand also to races in iso_conn_add() vs. iso_conn_free().\n\nFix by adding spinlock hci_conn::proto_lock and using it to guard\nhci_conn::iso_data."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/bluetooth/hci_core.h", "net/bluetooth/hci_conn.c", "net/bluetooth/iso.c"], "versions": [{"version": "dc26097bdb864a0d5955b9a25e43376ffc1af99b", "lessThan": "876a3e94c70d0859d1dad1c986112d4f0d99eba8", "status": "affected", "versionType": "git"}, {"version": "dc26097bdb864a0d5955b9a25e43376ffc1af99b", "lessThan": "af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c", "status": "affected", "versionType": "git"}, {"version": "f53e7489273dc2bb307bf50f319b3762d45534f0", "status": "affected", "versionType": "git"}, {"version": "a58d0f5dac322e16cc75334d000666512341bde5", "status": "affected", "versionType": "git"}, {"version": "6.11.11", "lessThan": "6.12", "status": "affected", "versionType": "semver"}, {"version": "6.12.2", "lessThan": "6.13", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/bluetooth/hci_core.h", "net/bluetooth/hci_conn.c", "net/bluetooth/iso.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc6", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.2-rc6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/876a3e94c70d0859d1dad1c986112d4f0d99eba8"}, {"url": "https://git.kernel.org/stable/c/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c"}], "title": "Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/bluetooth/hci_core.h", "net/bluetooth/hci_conn.c", "net/bluetooth/iso.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "876a3e94c70d0859d1dad1c986112d4f0d99eba8", "status": "affected", "version": "dc26097bdb864a0d5955b9a25e43376ffc1af99b", "versionType": "git"}, {"lessThan": "af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c", "status": "affected", "version": "dc26097bdb864a0d5955b9a25e43376ffc1af99b", "versionType": "git"}, {"status": "affected", "version": "f53e7489273dc2bb307bf50f319b3762d45534f0", "versionType": "git"}, {"status": "affected", "version": "a58d0f5dac322e16cc75334d000666512341bde5", "versionType": "git"}, {"lessThan": "6.12", "status": "affected", "version": "6.11.11", "versionType": "semver"}, {"lessThan": "6.13", "status": "affected", "version": "6.12.2", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/bluetooth/hci_core.h", "net/bluetooth/hci_conn.c", "net/bluetooth/iso.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc6", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix race of kfree vs kref_get_unless_zero\n\nhci_conn::iso_data is accessed and modified without lock or RCU.\nThis leads to a race\n\n [Task hdev->workqueue] \t[Task 2]\n iso_recv iso_conn_put(conn)\n conn = LOAD hcon->iso_data iso_conn_free(conn)\n iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL\n kfree(conn)\n kref_get_unless_zero(&conn->ref) /* UAF */\n\nand also to races in iso_conn_add() vs. iso_conn_free().\n\nFix by adding spinlock hci_conn::proto_lock and using it to guard\nhci_conn::iso_data."}], "id": "CVE-2026-74533", "lastModified": "2026-08-15T13:17:58.603", "metrics": {}, "published": "2026-08-15T13:17:58.603", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/876a3e94c70d0859d1dad1c986112d4f0d99eba8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}