CVE-2026-74535

CVE CVE-2026-74535EUVD EUVD-2026-59728Published 2026-08-15T12:27:48.000ZLast changed 2026-08-17T05:48:24.000ZCVSS 8.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout iso_sock_timeout() takes lock_sock, so sync disabling the timer while holding that lock may deadlock. iso_sock_timeout() may also run concurrently with iso_conn_del(), which leads to UAF [Task 1] [Task hdev->workqueue] iso_sock_timeout iso_conn_del iso_conn_hold_unless_zero iso_chan_del `------------> iso_conn_put caller frees hcon iso_conn_put iso_conn_free conn->hcon->iso_data = NULL; /* UAF */ Fix the deadlock by removing the disable from the lock_sock sections. Move the timer from iso_conn to iso_pinfo to decouple it from iso_conn which may need to be freed in lock_sock section. Convert some of the clear_timer to disable_timer.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux f53e7489273dc2bb307bf50f319b3762d45534f0; patch: 0; patch: 7.1.8; patch: 6.18.44; dc26097bdb864a0d5955b9a25e43376ffc1af99b <82e982f54f962f72646868ddbb2c3bd9ea178568; 6.11.11 <6.12; 6.12.2 <6.12.103; dc26097bdb864a0d5955b9a25e43376ffc1af99b <200fa1629c57a3ca2b03d3ca63fd3a9bfd910c43; patch: 6.12.103; 6.13; dc26097bdb864a0d5955b9a25e43376ffc1af99b <3c3d5f85db80145636bb991a6005e2760012b985; patch: 7.2; a58d0f5dac322e16cc75334d000666512341bde5 <16d89a63e08280abeef7218970a3bbd7ca62b021

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.