CVE-2026-74537: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2...

PT-2026-72993

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the Bluetooth ISO implementation. The problem occurs when detaching a connection from a host connection hcon, where failing to clear iso data while...

PT-2026-72988

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where socket references leak after socket release. This occurs because the iso sock kill function performs checks on SOCK ZAPPED, sk-s...

CVE-2026-74534: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of isoconn isoconndel and isochandel have a race that results to double-put of isoconn: Task hdev-workqueue Task 2 isoconndel isochandel isoconnholdunlesszero isoconnlock isoconnlock conn-sk = NULL...

PT-2026-72985

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Bluetooth ISO implementation where hci conn::iso data is accessed and modified without a lock or Read-Copy-Update RCU mechanism. This flaw can lead to a...

PT-2026-72986

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between the iso conn del and iso chan del functions in the Bluetooth ISO implementation. This race can lead to a double-put of the iso conn reference count,...

PT-2026-72987

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where the iso sock timeout function acquires lock sock. Synchronously disabling the timer while holding this lock can result in a...

PT-2026-72990

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where the iso connect ind function fails to acquire lock sock during the "ev3" phase. This leads to an unsafe access of iso pisk-conn,...

PT-2026-72522

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO handling where malformed ISO END or ISO CONT packets can cause system instability. If a controller sends a malformed sequence such as ISO START...

CVE-2026-72334: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

Linux Distros Unpatched Vulnerability : CVE-2026-74535

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: avoid deadlocks in isosocktimeout isosocktimeout takes locksock, so sync disabling the timer while holding that lock may deadlock. isosocktimeou...

CVE-2026-74539: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release...

CVE-2026-74538: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isoconnectind Accessing isopisk-conn requires locksock, which is not taken in the "ev3" part of isoconnectind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before...

CVE-2026-74541: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: clear isodata always when detaching conn from hcon When setting conn-hcon = NULL, also conn-hcon-isodata = NULL is necessary, otherwise later isoconnfree will UAF. Fix clearing of isodata in isosockdisconn Fixes...

PT-2026-72991

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where the iso sock getname function accesses iso pisk-conn without holding the required lock sock. This lack of proper locking can lea...

Linux Distros Unpatched Vulnerability : CVE-2026-74539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release. CVE-2026-74539 Note...

Linux Distros Unpatched Vulnerability : CVE-2026-74541

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: clear isodata always when detaching conn from hcon When setting conn-hcon = NULL, also conn-hcon-isodata = NULL is necessary, otherwise later...

Linux Distros Unpatched Vulnerability : CVE-2026-74534

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix refcounting of isoconn isoconndel and isochandel have a race that results to double-put of isoconn: Task hdev-workqueue Task 2 isoconndel...

Linux Distros Unpatched Vulnerability : CVE-2026-74537

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close...

Linux Distros Unpatched Vulnerability : CVE-2026-72334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject...