CVE-2026-74541: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: clear isodata always when detaching conn from hcon When setting conn-hcon = NULL, also conn-hcon-isodata = NULL is necessary, otherwise later isoconnfree will UAF. Fix clearing of isodata in isosockdisconn Fixes...

PT-2026-72987

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where the iso sock timeout function acquires lock sock. Synchronously disabling the timer while holding this lock can result in a...

PT-2026-72986

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between the iso conn del and iso chan del functions in the Bluetooth ISO implementation. This race can lead to a double-put of the iso conn reference count,...

PT-2026-72990

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where the iso connect ind function fails to acquire lock sock during the "ev3" phase. This leads to an unsafe access of iso pisk-conn,...

PT-2026-72993

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the Bluetooth ISO implementation. The problem occurs when detaching a connection from a host connection hcon, where failing to clear iso data while...

PT-2026-72988

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where socket references leak after socket release. This occurs because the iso sock kill function performs checks on SOCK ZAPPED, sk-s...

PT-2026-72985

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Bluetooth ISO implementation where hci conn::iso data is accessed and modified without a lock or Read-Copy-Update RCU mechanism. This flaw can lead to a...

CVE-2026-74537: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2...

CVE-2026-74534: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of isoconn isoconndel and isochandel have a race that results to double-put of isoconn: Task hdev-workqueue Task 2 isoconndel isochandel isoconnholdunlesszero isoconnlock isoconnlock conn-sk = NULL...

CVE-2026-74539: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release...

Linux Distros Unpatched Vulnerability : CVE-2026-74535

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: avoid deadlocks in isosocktimeout isosocktimeout takes locksock, so sync disabling the timer while holding that lock may deadlock. isosocktimeou...

Linux Distros Unpatched Vulnerability : CVE-2026-74541

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: clear isodata always when detaching conn from hcon When setting conn-hcon = NULL, also conn-hcon-isodata = NULL is necessary, otherwise later...

Linux Distros Unpatched Vulnerability : CVE-2026-74537

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close...

Linux Distros Unpatched Vulnerability : CVE-2026-72334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject...

PT-2026-72522

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO handling where malformed ISO END or ISO CONT packets can cause system instability. If a controller sends a malformed sequence such as ISO START...

PT-2026-72991

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where the iso sock getname function accesses iso pisk-conn without holding the required lock sock. This lack of proper locking can lea...

CVE-2026-72334: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

Linux Distros Unpatched Vulnerability : CVE-2026-74534

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix refcounting of isoconn isoconndel and isochandel have a race that results to double-put of isoconn: Task hdev-workqueue Task 2 isoconndel...

Linux Distros Unpatched Vulnerability : CVE-2026-74539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release. CVE-2026-74539 Note...

CVE-2026-74538: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isoconnectind Accessing isopisk-conn requires locksock, which is not taken in the "ev3" part of isoconnectind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before...