CVE-2026-74535

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. This vulnerability arises from a race condition where the iso_sock_timeout() function can execute concurrently with iso_conn_del(), leading to a Use-After-Free (UAF) condition. A UAF vulnerability allows an attacker to potentially execute arbitrary code or cause a denial of service by manipulating freed memory. Additionally, a deadlock can occur if iso_sock_timeout() attempts to disable a timer while holding a lock, further contributing to a denial of service.

A race in Bluetooth ISO timeout handling can occur because iso_sock_timeout runs from delayed work while iso_conn_del may concurrently delete the ISO channel and drop the last connection reference. The delayed work was stored in iso_conn, and later cleanup can reach conn hcon iso_data after the related hci_conn has already been freed, creating a use-after-free condition and possible kernel crash. The same lifetime and locking pattern can also deadlock when synchronous timer disabling is performed while lock_sock is held, because the timeout worker also takes lock_sock. For the CVSS the PR:L because reliable triggering normally requires a local process that can create or operate Bluetooth ISO sockets, while a remote Bluetooth peer alone is not clearly sufficient from the patch context. The issue is not reachable over an IP network, but Bluetooth radio proximity or peer behavior may affect timing once a local ISO socket workflow exists.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.