{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-74539", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.913Z", "datePublished": "2026-08-15T12:27:50.902Z", "dateUpdated": "2026-10-16T19:05:54.465Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:48:27.740Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: lock sk in iso_sock_getname\n\nAccessing iso_pi(sk)->conn requires lock_sock, which is not held here.\n\nFix by adding the lock/release." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The unlocked `iso_sock_getname()` path is entered only via the local `getpeername()` syscall, but the freeing side races through `iso_conn_del()`/`iso_chan_del()` driven by HCI connect/disconnect events that an adjacent Bluetooth peer can time (CIS/BIS/PA teardown on LE Audio phones, headsets, or kiosks).\nAC:L - An attacker controls both race sides: one thread loops `getpeername()` on a `BTPROTO_ISO` socket while another concurrently calls `close()`/`connect()` or an adjacent peer provokes HCI disconnect; unlimited retries make winning the TOCTOU on `iso_pi(sk)->conn` reliably achievable.\nPR:L - `iso_sock_create()`/`bt_sock_create()` impose no `CAP_NET_ADMIN` or other capability check; any unprivileged local user in the initial network namespace who can open `AF_BLUETOOTH`/`BTPROTO_ISO` sockets can reach the vulnerable `getpeername()` handler (Bluetooth is unavailable in user namespaces).\nUI:N - Exploitation requires only attacker-controlled ISO socket syscalls and concurrent connection teardown; no victim pairing prompt, mount, or other deliberate user action beyond normal Bluetooth LE Audio use on an already-configured device.\nS:U - Impact is kernel heap UAF/crash or privilege escalation within the host kernel security boundary; it does not cross VM, hypervisor, IOMMU, or application-sandbox boundaries.\nC:H - The double-read `iso_pi(sk)->conn ? iso_pi(sk)->conn->hcon` without `lock_sock` is a classic TOCTOU UAF; dereferencing a freed `iso_conn` and stale `hcon` exposes attacker-influenced kernel heap contents and is leverageable for arbitrary memory disclosure.\nI:H - UAF on the `iso_conn` kmalloc object (~136-byte slab) enables heap grooming/spray; corrupted `hcon` pointers and subsequent kernel reads through attacker-controlled freed memory provide write primitives chainable to control-flow hijack per kernel UAF scoring guidance.\nA:H - Racing `iso_chan_del()` during the unlocked `conn->hcon` dereference or `hcon->type` access can cause immediate kernel oops/panic from NULL/invalid pointer access; UAF in connection teardown independently threatens host availability even before full exploitation." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/bluetooth/iso.c" ], "versions": [ { "version": "2df108c227b266a9ec9e3fda3828d2ac9662aa33", "lessThan": "72d5bb1d77d7c3330146dc0cfd43f704c64b9594", "status": "affected", "versionType": "git" }, { "version": "2df108c227b266a9ec9e3fda3828d2ac9662aa33", "lessThan": "202670e6602e068558c1fca2df40719ee91a2906", "status": "affected", "versionType": "git" }, { "version": "2df108c227b266a9ec9e3fda3828d2ac9662aa33", "lessThan": "89cf154d7c18e6e94a3da83051f3cf2bac317ae2", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/bluetooth/iso.c" ], "versions": [ { "version": "6.16", "status": "affected" }, { "version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.44" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/72d5bb1d77d7c3330146dc0cfd43f704c64b9594" }, { "url": "https://git.kernel.org/stable/c/202670e6602e068558c1fca2df40719ee91a2906" }, { "url": "https://git.kernel.org/stable/c/89cf154d7c18e6e94a3da83051f3cf2bac317ae2" } ], "title": "Bluetooth: ISO: lock sk in iso_sock_getname", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2026-74539", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2026-10-16T18:59:39.142927Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:05:54.465Z" } } ] } }