19267 matches found
CVE-2026-74538
Vulnerability CVE-2026-74538 affects the Linux kernel Bluetooth ISO handling. Accessing iso_pi(sk)->conn may race with locking because lock_sock is not ensured in the ev3 portion of iso_connect_ind, and conn may be NULL if the socket transitions from LISTEN/CONNECT before locking. A fix adds p...
CVE-2026-74539
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release...
CVE-2026-74538 Bluetooth: ISO: lock sk in iso_connect_ind
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isoconnectind Accessing isopisk-conn requires locksock, which is not taken in the "ev3" part of isoconnectind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before...
CVE-2026-74539
The CVE-2026-74539 entry affects the Linux kernel Bluetooth ISO path. The root cause is that accessing iso_pi(sk)->conn requires lock_sock, but the lock was not held in iso_sock_getname. The fix implemented is to add the appropriate lock and release around this usage. Documents from NVD/SUSE/O...
CVE-2026-74539 Bluetooth: ISO: lock sk in iso_sock_getname
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release...
CVE-2026-74538
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isoconnectind Accessing isopisk-conn requires locksock, which is not taken in the "ev3" part of isoconnectind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before...
CVE-2026-74539
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release...
EUVD-2026-59732
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release...
CVE-2026-74538 Bluetooth: ISO: lock sk in iso_connect_ind
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isoconnectind Accessing isopisk-conn requires locksock, which is not taken in the "ev3" part of isoconnectind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before...
EUVD-2026-59729
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release isosockkill tests !sockflagsk, SOCKZAPPED || sk-sksocket || sockflagsk, SOCKDEAD for early return, but this is always true since sockorphansk sets SOCKDEAD, so the sk reference...
CVE-2026-74537
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2...
CVE-2026-74536
In CVE-2026-74536, the Linux kernel Bluetooth ISO stack suffers a leak: iso_sock_kill() can leak the sk reference after socket release or when __iso_sock_close() does not set SOCK_ZAPPED, because sock_orphan(sk) marks SOCK_DEAD. The fix replaces SOCK_DEAD with a dedicated BT_SK_KILLED flag and ad...
CVE-2026-74537
The CVE-2026-74537 entry concerns the Linux kernel Bluetooth ISO path. A use-after-free could occur when dereferencing conn->sk in iso_conn_ready because the socket was accessed without holding a lock or a refcount. The fix adds a socket refcount in iso_conn_ready and rechecks socket validity ...
CVE-2026-74537 Bluetooth: ISO: hold sk properly in iso_conn_ready
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2...
CVE-2026-74536 Bluetooth: ISO: fix leaking sk after socket release
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release isosockkill tests !sockflagsk, SOCKZAPPED || sk-sksocket || sockflagsk, SOCKDEAD for early return, but this is always true since sockorphansk sets SOCKDEAD, so the sk reference...
CVE-2026-74537
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2...
EUVD-2026-59730
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2...
CVE-2026-74537 Bluetooth: ISO: hold sk properly in iso_conn_ready
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2...
CVE-2026-74536 Bluetooth: ISO: fix leaking sk after socket release
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release isosockkill tests !sockflagsk, SOCKZAPPED || sk-sksocket || sockflagsk, SOCKDEAD for early return, but this is always true since sockorphansk sets SOCKDEAD, so the sk reference...
CVE-2026-74536
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release isosockkill tests !sockflagsk, SOCKZAPPED || sk-sksocket || sockflagsk, SOCKDEAD for early return, but this is always true since sockorphansk sets SOCKDEAD, so the sk reference...