CVE-2026-74539

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. A missing lock in a critical function allows for concurrent access to internal data structures without proper synchronization. This concurrency issue could lead to system instability or a denial of service, impacting the availability of the system.

Bluetooth ISO iso_sock_getname accessed iso_pi(sk) connection state without holding the socket lock even though iso_pi(sk) conn requires lock_sock protection. A local process operating an AF_BLUETOOTH ISO socket could race getpeername() or getsockname() with connection teardown or state changes, potentially leading to a stale connection pointer dereference, kernel crash, or use-after-free behavior. For the CVSS the PR:L is used because a local process must be able to operate an AF_BLUETOOTH ISO socket and trigger the local socket API path. The issue is not directly network reachable through IP networking. Bluetooth peer activity may influence connection state timing, but reliable triggering still depends on the local socket operation. Impact is at least local denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.