CVE-2026-74533

A flaw was found in the Bluetooth ISO subsystem of the Linux kernel. This vulnerability is caused by a race condition where certain data is accessed and modified without proper synchronization, leading to a use-after-free (UAF) error. An attacker could potentially exploit this to execute arbitrary code or cause the system to crash, resulting in a denial of service.

A race in Bluetooth ISO connection lifetime handling can cause a use-after-free because hci_conn::iso_data was read and cleared without a common lock while kref_get_unless_zero() could run concurrently with kfree(). The vulnerable path involves iso_recv using hcon::iso_data while another task releases the same iso_conn, so a stale pointer may be dereferenced in kernel context. For the CVSS the PR:N value is used for the paranoid score because a Bluetooth adjacent peer may be able to influence ISO receive and disconnect timing without local privileges on the target, although reliable triggering likely requires an active ISO capable Bluetooth setup and a narrow race window. The issue is not Internet reachable but can be adjacent-network reachable over Bluetooth radio range.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.