{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74539","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.913Z","datePublished":"2026-08-15T12:27:50.902Z","dateUpdated":"2026-08-17T05:48:27.740Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:48:27.740Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: lock sk in iso_sock_getname\n\nAccessing iso_pi(sk)->conn requires lock_sock, which is not held here.\n\nFix by adding the lock/release."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The unlocked `iso_sock_getname()` path is entered only via the local `getpeername()` syscall, but the freeing side races through `iso_conn_del()`/`iso_chan_del()` driven by HCI connect/disconnect events that an adjacent Bluetooth peer can time (CIS/BIS/PA teardown on LE Audio phones, headsets, or kiosks).\nAC:L - An attacker controls both race sides: one thread loops `getpeername()` on a `BTPROTO_ISO` socket while another concurrently calls `close()`/`connect()` or an adjacent peer provokes HCI disconnect; unlimited retries make winning the TOCTOU on `iso_pi(sk)->conn` reliably achievable.\nPR:L - `iso_sock_create()`/`bt_sock_create()` impose no `CAP_NET_ADMIN` or other capability check; any unprivileged local user in the initial network namespace who can open `AF_BLUETOOTH`/`BTPROTO_ISO` sockets can reach the vulnerable `getpeername()` handler (Bluetooth is unavailable in user namespaces).\nUI:N - Exploitation requires only attacker-controlled ISO socket syscalls and concurrent connection teardown; no victim pairing prompt, mount, or other deliberate user action beyond normal Bluetooth LE Audio use on an already-configured device.\nS:U - Impact is kernel heap UAF/crash or privilege escalation within the host kernel security boundary; it does not cross VM, hypervisor, IOMMU, or application-sandbox boundaries.\nC:H - The double-read `iso_pi(sk)->conn ? iso_pi(sk)->conn->hcon` without `lock_sock` is a classic TOCTOU UAF; dereferencing a freed `iso_conn` and stale `hcon` exposes attacker-influenced kernel heap contents and is leverageable for arbitrary memory disclosure.\nI:H - UAF on the `iso_conn` kmalloc object (~136-byte slab) enables heap grooming/spray; corrupted `hcon` pointers and subsequent kernel reads through attacker-controlled freed memory provide write primitives chainable to control-flow hijack per kernel UAF scoring guidance.\nA:H - Racing `iso_chan_del()` during the unlocked `conn->hcon` dereference or `hcon->type` access can cause immediate kernel oops/panic from NULL/invalid pointer access; UAF in connection teardown independently threatens host availability even before full exploitation."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/iso.c"],"versions":[{"version":"2df108c227b266a9ec9e3fda3828d2ac9662aa33","lessThan":"72d5bb1d77d7c3330146dc0cfd43f704c64b9594","status":"affected","versionType":"git"},{"version":"2df108c227b266a9ec9e3fda3828d2ac9662aa33","lessThan":"202670e6602e068558c1fca2df40719ee91a2906","status":"affected","versionType":"git"},{"version":"2df108c227b266a9ec9e3fda3828d2ac9662aa33","lessThan":"89cf154d7c18e6e94a3da83051f3cf2bac317ae2","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/iso.c"],"versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","status":"unaffected","versionType":"semver"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"6.18.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.1.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/72d5bb1d77d7c3330146dc0cfd43f704c64b9594"},{"url":"https://git.kernel.org/stable/c/202670e6602e068558c1fca2df40719ee91a2906"},{"url":"https://git.kernel.org/stable/c/89cf154d7c18e6e94a3da83051f3cf2bac317ae2"}],"title":"Bluetooth: ISO: lock sk in iso_sock_getname","x_generator":{"engine":"bippy-1.2.0"}}}}