CVE-2026-74536

A flaw was found in the Bluetooth ISO subsystem of the Linux kernel. This vulnerability occurs due to an issue in how socket references are managed after a socket is released, specifically within the iso_sock_kill() and __iso_sock_close() functions. This improper handling leads to a memory leak, which a local attacker could exploit to exhaust system resources and cause a Denial of Service (DoS).

This vulnerability is rated with a Low impact because exploitation requires local access and the resulting memory leak only leads to denial of service through resource exhaustion, without granting elevated privileges or compromising system integrity. In standard Red Hat Enterprise Linux server environments, Bluetooth interfaces and services are typically inactive or not deployed, significantly limiting exposure. Additionally, Red Hat Enterprise Linux 8 and earlier versions do not contain the affected code and are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.