CVE-2026-74537
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in iso_conn_ready sk deref in iso_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either: [Task 1] [Task 2] iso_sock_release iso_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) iso_sock_kill(sk) UAF on sk deref Fix possible UAF by holding sk refcount in iso_conn_ready(). Also recheck after lock_sock that the socket is still valid. Adjust locking so conn->sk is cleared only under lock_sock.
- Affected products
- Kernel, Linux, Linux-Allwinner-5.19, Linux-Aws, Linux-Aws-5.0, Linux-Aws-5.11, Linux-Aws-5.13, Linux-Aws-5.15
- CVSS 3.1
- 8.8 HIGH
- EPSS
- 0.2% (15th percentile)
- NVD status
- Received
- Published
- 2026-08-15
No indexed exploits for CVE-2026-74537 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-74537 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.