CVE-2026-74539 Bluetooth: ISO: lock sk in iso_sock_getname

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release...

CVE-2026-74538

Vulnerability CVE-2026-74538 affects the Linux kernel Bluetooth ISO handling. Accessing iso_pi(sk)->conn may race with locking because lock_sock is not ensured in the ev3 portion of iso_connect_ind, and conn may be NULL if the socket transitions from LISTEN/CONNECT before locking. A fix adds p...

EUVD-2026-59732

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release...

CVE-2026-74539

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release...

CVE-2026-74538

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isoconnectind Accessing isopisk-conn requires locksock, which is not taken in the "ev3" part of isoconnectind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before...

CVE-2026-74539

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release...

CVE-2026-74538

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isoconnectind Accessing isopisk-conn requires locksock, which is not taken in the "ev3" part of isoconnectind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before...

CVE-2026-74538 Bluetooth: ISO: lock sk in iso_connect_ind

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isoconnectind Accessing isopisk-conn requires locksock, which is not taken in the "ev3" part of isoconnectind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before...

CVE-2026-74539 Bluetooth: ISO: lock sk in iso_sock_getname

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release...

CVE-2026-74539

The CVE-2026-74539 entry affects the Linux kernel Bluetooth ISO path. The root cause is that accessing iso_pi(sk)->conn requires lock_sock, but the lock was not held in iso_sock_getname. The fix implemented is to add the appropriate lock and release around this usage. Documents from NVD/SUSE/O...

CVE-2026-74538 Bluetooth: ISO: lock sk in iso_connect_ind

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isoconnectind Accessing isopisk-conn requires locksock, which is not taken in the "ev3" part of isoconnectind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before...

CVE-2026-74536

In CVE-2026-74536, the Linux kernel Bluetooth ISO stack suffers a leak: iso_sock_kill() can leak the sk reference after socket release or when __iso_sock_close() does not set SOCK_ZAPPED, because sock_orphan(sk) marks SOCK_DEAD. The fix replaces SOCK_DEAD with a dedicated BT_SK_KILLED flag and ad...

CVE-2026-74536 Bluetooth: ISO: fix leaking sk after socket release

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release isosockkill tests !sockflagsk, SOCKZAPPED || sk-sksocket || sockflagsk, SOCKDEAD for early return, but this is always true since sockorphansk sets SOCKDEAD, so the sk reference...

CVE-2026-74537

The CVE-2026-74537 entry concerns the Linux kernel Bluetooth ISO path. A use-after-free could occur when dereferencing conn->sk in iso_conn_ready because the socket was accessed without holding a lock or a refcount. The fix adds a socket refcount in iso_conn_ready and rechecks socket validity ...

CVE-2026-74537

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2...

CVE-2026-74537 Bluetooth: ISO: hold sk properly in iso_conn_ready

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2...

CVE-2026-74537

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2...

EUVD-2026-59729

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release isosockkill tests !sockflagsk, SOCKZAPPED || sk-sksocket || sockflagsk, SOCKDEAD for early return, but this is always true since sockorphansk sets SOCKDEAD, so the sk reference...

CVE-2026-74536 Bluetooth: ISO: fix leaking sk after socket release

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release isosockkill tests !sockflagsk, SOCKZAPPED || sk-sksocket || sockflagsk, SOCKDEAD for early return, but this is always true since sockorphansk sets SOCKDEAD, so the sk reference...

CVE-2026-74535 Bluetooth: ISO: avoid deadlocks in iso_sock_timeout

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in isosocktimeout isosocktimeout takes locksock, so sync disabling the timer while holding that lock may deadlock. isosocktimeout may also run concurrently with isoconndel, which leads to UAF Task ...