CVE-2026-74534

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. A race condition between iso_conn_del() and iso_chan_del() functions can lead to a double-put of iso_conn objects. This can result in a Use-After-Free (UAF) vulnerability, potentially allowing an attacker to cause a denial of service or achieve arbitrary code execution.

A race in Bluetooth/ISO connection teardown can cause a double put of iso_conn when iso_conn_del runs concurrently with iso_chan_del. The resulting refcount imbalance can free the connection object while another path still operates on it, creating a use-after-free condition in kernel memory. For the CVSS the PR:L is used because reliable triggering appears to require a local user process or local service that can create or tear down Bluetooth ISO sockets. The issue is not directly reachable over normal IP networking. A nearby Bluetooth peer may help influence connection events, but the patch context still points to a local endpoint race rather than a purely remote trigger. Impact is at least local denial of service via kernel crash. In the paranoid score, impact is raised to C:H/I:H/A:H because the bug class is explicit UAF from refcounting and may allow privilege escalation if heap reuse can be controlled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.