From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-74534: Bluetooth: ISO: fix refcounting of iso_conn
Date: Sat, 15 Aug 2026 21:26:55 +0900 [thread overview]
Message-ID: <2026081547-CVE-2026-74534-ef5e@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: fix refcounting of iso_conn
iso_conn_del() and iso_chan_del() have a race that results to double-put
of iso_conn:
[Task hdev->workqueue] [Task 2]
iso_conn_del iso_chan_del
iso_conn_hold_unless_zero iso_conn_lock
iso_conn_lock conn->sk = NULL
iso_conn_unlock
sk = iso_sock_hold(conn) <---------´
if (!sk) iso_conn_put iso_conn_put
iso_conn_put /* UAF */
The extra put for !sk in iso_conn_del() is currently required since
failing iso_chan_add() may leave iso_conn not associated with any sk.
Fix by having iso_pi(sk)->conn own refcount when non-NULL, so
iso_conn_del does not need to put it. Adjust the iso_conn_add()
refcounting so that conn is put if it does not get associated with an
sk.
The Linux kernel CVE team has assigned CVE-2026-74534 to this issue.
Affected and fixed versions
===========================
Issue introduced in 6.13 with commit dc26097bdb864a0d5955b9a25e43376ffc1af99b and fixed in 6.18.44 with commit 3b921533e8aa95b77aadcf31737595578e735f3c
Issue introduced in 6.13 with commit dc26097bdb864a0d5955b9a25e43376ffc1af99b and fixed in 7.1.8 with commit 8208b4939afb0a1977fffe902c3ca42fe0f3baaa
Issue introduced in 6.13 with commit dc26097bdb864a0d5955b9a25e43376ffc1af99b and fixed in 7.2-rc6 with commit fdfde532ab1caa165fcd8985001157ac8b4db365
Issue introduced in 6.11.11 with commit f53e7489273dc2bb307bf50f319b3762d45534f0
Issue introduced in 6.12.2 with commit a58d0f5dac322e16cc75334d000666512341bde5
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-74534
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
net/bluetooth/iso.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/3b921533e8aa95b77aadcf31737595578e735f3c
https://git.kernel.org/stable/c/8208b4939afb0a1977fffe902c3ca42fe0f3baaa
https://git.kernel.org/stable/c/fdfde532ab1caa165fcd8985001157ac8b4db365
reply other threads:[~2026-08-15 12:31 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026081547-CVE-2026-74534-ef5e@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox