{"id":"CVE-2026-74539","state":"PUBLISHED","title":"Bluetooth: ISO: lock sk in iso_sock_getname","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: lock sk in iso_sock_getname\n\nAccessing iso_pi(sk)->conn requires lock_sock, which is not held here.\n\nFix by adding the lock/release.","publishedAt":"2026-08-15T12:27:50.902Z","updatedAt":"2026-10-16T19:05:54.465Z","severity":{"score":8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2df108c227b266a9ec9e3fda3828d2ac9662aa33","status":"affected","lessThan":"72d5bb1d77d7c3330146dc0cfd43f704c64b9594","versionType":"git"},{"version":"2df108c227b266a9ec9e3fda3828d2ac9662aa33","status":"affected","lessThan":"202670e6602e068558c1fca2df40719ee91a2906","versionType":"git"},{"version":"2df108c227b266a9ec9e3fda3828d2ac9662aa33","status":"affected","lessThan":"89cf154d7c18e6e94a3da83051f3cf2bac317ae2","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/iso.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.16","versionType":"semver"},{"version":"6.18.44","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.8","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/iso.c"]}],"references":["https://git.kernel.org/stable/c/72d5bb1d77d7c3330146dc0cfd43f704c64b9594","https://git.kernel.org/stable/c/202670e6602e068558c1fca2df40719ee91a2906","https://git.kernel.org/stable/c/89cf154d7c18e6e94a3da83051f3cf2bac317ae2"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/74xxx/CVE-2026-74539.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74539","state":"PUBLISHED","datePublished":"2026-08-15T12:27:50.902Z","dateUpdated":"2026-10-16T19:05:54.465Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-15T05:44:03.913Z"},"containers":{"cna":{"title":"Bluetooth: ISO: lock sk in iso_sock_getname","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: lock sk in iso_sock_getname\n\nAccessing iso_pi(sk)->conn requires lock_sock, which is not held here.\n\nFix by adding the lock/release."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2df108c227b266a9ec9e3fda3828d2ac9662aa33","status":"affected","lessThan":"72d5bb1d77d7c3330146dc0cfd43f704c64b9594","versionType":"git"},{"version":"2df108c227b266a9ec9e3fda3828d2ac9662aa33","status":"affected","lessThan":"202670e6602e068558c1fca2df40719ee91a2906","versionType":"git"},{"version":"2df108c227b266a9ec9e3fda3828d2ac9662aa33","status":"affected","lessThan":"89cf154d7c18e6e94a3da83051f3cf2bac317ae2","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/iso.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.16","versionType":"semver"},{"version":"6.18.44","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.8","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/iso.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/72d5bb1d77d7c3330146dc0cfd43f704c64b9594"},{"url":"https://git.kernel.org/stable/c/202670e6602e068558c1fca2df40719ee91a2906"},{"url":"https://git.kernel.org/stable/c/89cf154d7c18e6e94a3da83051f3cf2bac317ae2"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The unlocked `iso_sock_getname()` path is entered only via the local `getpeername()` syscall, but the freeing side races through `iso_conn_del()`/`iso_chan_del()` driven by HCI connect/disconnect events that an adjacent Bluetooth peer can time (CIS/BIS/PA teardown on LE Audio phones, headsets, or kiosks).\nAC:L - An attacker controls both race sides: one thread loops `getpeername()` on a `BTPROTO_ISO` socket while another concurrently calls `close()`/`connect()` or an adjacent peer provokes HCI disconnect; unlimited retries make winning the TOCTOU on `iso_pi(sk)->conn` reliably achievable.\nPR:L - `iso_sock_create()`/`bt_sock_create()` impose no `CAP_NET_ADMIN` or other capability check; any unprivileged local user in the initial network namespace who can open `AF_BLUETOOTH`/`BTPROTO_ISO` sockets can reach the vulnerable `getpeername()` handler (Bluetooth is unavailable in user namespaces).\nUI:N - Exploitation requires only attacker-controlled ISO socket syscalls and concurrent connection teardown; no victim pairing prompt, mount, or other deliberate user action beyond normal Bluetooth LE Audio use on an already-configured device.\nS:U - Impact is kernel heap UAF/crash or privilege escalation within the host kernel security boundary; it does not cross VM, hypervisor, IOMMU, or application-sandbox boundaries.\nC:H - The double-read `iso_pi(sk)->conn ? iso_pi(sk)->conn->hcon` without `lock_sock` is a classic TOCTOU UAF; dereferencing a freed `iso_conn` and stale `hcon` exposes attacker-influenced kernel heap contents and is leverageable for arbitrary memory disclosure.\nI:H - UAF on the `iso_conn` kmalloc object (~136-byte slab) enables heap grooming/spray; corrupted `hcon` pointers and subsequent kernel reads through attacker-controlled freed memory provide write primitives chainable to control-flow hijack per kernel UAF scoring guidance.\nA:H - Racing `iso_chan_del()` during the unlocked `conn->hcon` dereference or `hcon->type` access can cause immediate kernel oops/panic from NULL/invalid pointer access; UAF in connection teardown independently threatens host availability even before full exploitation."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T05:48:27.740Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"6.18.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.1.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-74539","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T18:59:39.142927Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:05:54.465Z"}}]}}}