CVE-2026-74537

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. A race condition in the iso_conn_ready function allows a socket to be prematurely freed while still in use. This Use-After-Free (UAF) vulnerability could lead to memory corruption, potentially causing a system crash or other unpredictable behavior.

A race in Bluetooth ISO connection setup can allow iso_conn_ready to dereference a sock after a concurrent iso_sock_release clears and kills the socket. The vulnerable path reads conn sk without holding conn lock or a socket reference, then lock_sock can operate on a freed sock and trigger a use-after-free. A local process that can create and close Bluetooth ISO sockets can race against connection ready processing, and a nearby Bluetooth peer may help generate the timing events. For the CVSS the PR:L is used because reliable triggering still requires a local user or process context on the target. Impact is at least local denial of service via kernel crash and in the paranoid case may include confidentiality and integrity impact because this is a real kernel use-after-free on struct sock rather than a pure NULL dereference.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.