CVE-2026-74538

A flaw was found in the Linux kernel's Bluetooth ISO (Isochronous Stream) subsystem. A missing lock when accessing socket connection information within the iso_connect_ind function could lead to a null pointer dereference. This vulnerability could allow a local attacker to cause a system crash, resulting in a Denial of Service (DoS).

A race in the Bluetooth/ISO connect indication path can access ISO socket private connection state without holding the socket lock. The ev3 path can read a stale or NULL connection pointer if the socket leaves LISTEN or CONNECT state while HCI event handling is in progress, which can lead to a NULL pointer dereference and kernel crash. Because the access is protected by lock_sock in adjacent paths, the missing lock indicates a real synchronization bug and a possible UAF candidate if the connection object is freed concurrently. For the CVSS the PR:N is used in the paranoid score because an adjacent Bluetooth attacker may trigger the HCI event stream without a local account when a vulnerable ISO listener is already present, although reliable exploitation likely depends on timing and local Bluetooth configuration. The issue is adjacent network reachable over Bluetooth rather than Internet reachable. Impact is at least denial of service and in worst case may allow limited confidentiality or integrity impact due to race based memory corruption risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.