CVE-2026-74541 (GCVE-0-2026-74541)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-17 05:48
VLAI
Title
Bluetooth: ISO: clear iso_data always when detaching conn from hcon
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: clear iso_data always when detaching conn from hcon When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is necessary, otherwise later iso_conn_free() will UAF. Fix clearing of iso_data in iso_sock_disconn() Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on iso_sock_release() followed by hci_abort_conn_sync().
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fbdc4bc47268953c80853489f696e02d61f9a2c6 , < cc1d39946d62bc568551dfb81149724de1e91338 (git)
Affected: fbdc4bc47268953c80853489f696e02d61f9a2c6 , < 7b51a9c25e9698b64df9f2218f10eecf7dc7e2d0 (git)
Affected: fbdc4bc47268953c80853489f696e02d61f9a2c6 , < 63c0f396a18b767eb28e895eb95bbdce6c172c59 (git)
Affected: fbdc4bc47268953c80853489f696e02d61f9a2c6 , < 69a4a7b162b3db6ac337e3094cdee38f24d42ff7 (git)
Affected: fbdc4bc47268953c80853489f696e02d61f9a2c6 , < d57e506f6a1e3929611340fae87c1e4823f4d85c (git)
Affected: c03a10bd5b6ccb22921e04bcddc987410df7e7a9 (git)
Affected: 6.5.12 , < 6.6 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc1d39946d62bc568551dfb81149724de1e91338",
              "status": "affected",
              "version": "fbdc4bc47268953c80853489f696e02d61f9a2c6",
              "versionType": "git"
            },
            {
              "lessThan": "7b51a9c25e9698b64df9f2218f10eecf7dc7e2d0",
              "status": "affected",
              "version": "fbdc4bc47268953c80853489f696e02d61f9a2c6",
              "versionType": "git"
            },
            {
              "lessThan": "63c0f396a18b767eb28e895eb95bbdce6c172c59",
              "status": "affected",
              "version": "fbdc4bc47268953c80853489f696e02d61f9a2c6",
              "versionType": "git"
            },
            {
              "lessThan": "69a4a7b162b3db6ac337e3094cdee38f24d42ff7",
              "status": "affected",
              "version": "fbdc4bc47268953c80853489f696e02d61f9a2c6",
              "versionType": "git"
            },
            {
              "lessThan": "d57e506f6a1e3929611340fae87c1e4823f4d85c",
              "status": "affected",
              "version": "fbdc4bc47268953c80853489f696e02d61f9a2c6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c03a10bd5b6ccb22921e04bcddc987410df7e7a9",
              "versionType": "git"
            },
            {
              "lessThan": "6.6",
              "status": "affected",
              "version": "6.5.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: clear iso_data always when detaching conn from hcon\n\nWhen setting conn-\u003ehcon = NULL, also conn-\u003ehcon-\u003eiso_data = NULL is\nnecessary, otherwise later iso_conn_free() will UAF.\n\nFix clearing of iso_data in iso_sock_disconn()\n\nFixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on\niso_sock_release() followed by hci_abort_conn_sync()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The flaw is in the Bluetooth ISO stack (net/bluetooth/iso.c); exploitation occurs during ISO connection teardown reachable from adjacent Bluetooth LE Audio/CIS/BIS deployments on phones, laptops, and embedded systems where ISO HCI traffic is processed wirelessly.\nAC:L - The KASAN reproducer (iso_sock_release() then hci_abort_conn_sync()) is reliably triggered by closing an ISO socket while hci_conn_drop() runs; the attacker controls both the socket lifecycle and concurrent teardown timing without depending on uncontrollable memory layout.\nPR:N - AF_BLUETOOTH/BTPROTO_ISO sockets require no CAP_NET_ADMIN or CAP_NET_RAW; any unprivileged process in init_net can open, connect, and close ISO sockets, and adjacent Bluetooth peers can also dereference the stale hcon-\u003eiso_data via iso_recv() without host credentials.\nUI:N - No victim interaction is required when a malicious or compromised local process creates and closes its own ISO connection to trigger iso_sock_disconn(); exploitation does not depend on mounting filesystems or opening specific user files.\nS:U - The UAF corrupts kernel heap memory during ISO connection teardown, enabling standard local privilege escalation within the kernel security boundary rather than crossing VM, container, or IOMMU isolation boundaries.\nC:H - iso_conn_hold_unless_zero() performs kref_get_unless_zero() on a freed iso_conn slab object, a classic use-after-free that can expose adjacent kernel heap contents and be leveraged for arbitrary kernel memory disclosure.\nI:H - The UAF on iso_conn (containing kref, spinlock, and socket pointers) enables heap spraying and memory corruption primitives that can be chained for arbitrary kernel writes and control-flow hijacking.\nA:H - The bug was confirmed by KASAN as a slab use-after-free in iso_conn_hold_unless_zero during ISO socket release and hci_abort_conn_sync(), which causes kernel oops or panic and denial of service on affected systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:48:29.921Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cc1d39946d62bc568551dfb81149724de1e91338"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b51a9c25e9698b64df9f2218f10eecf7dc7e2d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/63c0f396a18b767eb28e895eb95bbdce6c172c59"
        },
        {
          "url": "https://git.kernel.org/stable/c/69a4a7b162b3db6ac337e3094cdee38f24d42ff7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d57e506f6a1e3929611340fae87c1e4823f4d85c"
        }
      ],
      "title": "Bluetooth: ISO: clear iso_data always when detaching conn from hcon",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74541",
    "datePublished": "2026-08-15T12:27:52.120Z",
    "dateReserved": "2026-08-15T05:44:03.914Z",
    "dateUpdated": "2026-08-17T05:48:29.921Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74541",
      "date": "2026-09-20",
      "epss": "0.00247",
      "percentile": "0.16255"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T15:05:00.000Z",
      "cve": "CVE-2026-74541",
      "id": "msrc_CVE-2026-74541",
      "initial_release_date": "2026-08-23T15:05:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Bluetooth: ISO: clear iso_data always when detaching conn from hcon",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74541.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/iso.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "cc1d39946d62bc568551dfb81149724de1e91338",
                    "status": "affected",
                    "version": "fbdc4bc47268953c80853489f696e02d61f9a2c6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7b51a9c25e9698b64df9f2218f10eecf7dc7e2d0",
                    "status": "affected",
                    "version": "fbdc4bc47268953c80853489f696e02d61f9a2c6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "63c0f396a18b767eb28e895eb95bbdce6c172c59",
                    "status": "affected",
                    "version": "fbdc4bc47268953c80853489f696e02d61f9a2c6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "69a4a7b162b3db6ac337e3094cdee38f24d42ff7",
                    "status": "affected",
                    "version": "fbdc4bc47268953c80853489f696e02d61f9a2c6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d57e506f6a1e3929611340fae87c1e4823f4d85c",
                    "status": "affected",
                    "version": "fbdc4bc47268953c80853489f696e02d61f9a2c6",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "c03a10bd5b6ccb22921e04bcddc987410df7e7a9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "affected",
                    "version": "6.5.12",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/iso.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: clear iso_data always when detaching conn from hcon\n\nWhen setting conn-\u003ehcon = NULL, also conn-\u003ehcon-\u003eiso_data = NULL is\nnecessary, otherwise later iso_conn_free() will UAF.\n\nFix clearing of iso_data in iso_sock_disconn()\n\nFixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on\niso_sock_release() followed by hci_abort_conn_sync()."
          }
        ],
        "id": "CVE-2026-74541",
        "lastModified": "2026-08-17T06:19:51.297",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:17:59.443",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/63c0f396a18b767eb28e895eb95bbdce6c172c59"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/69a4a7b162b3db6ac337e3094cdee38f24d42ff7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7b51a9c25e9698b64df9f2218f10eecf7dc7e2d0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cc1d39946d62bc568551dfb81149724de1e91338"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d57e506f6a1e3929611340fae87c1e4823f4d85c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T19:39:49+00:00",
      "cve": "CVE-2026-74541",
      "id": "CVE-2026-74541",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: ISO: clear iso_data always when detaching conn from hcon",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74541.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-10T02:00:34Z",
      "cve": "CVE-2026-74541",
      "id": "CVE-2026-74541",
      "initial_release_date": "2026-08-15T23:50:42Z",
      "product_status:known_affected": "47",
      "product_status:known_not_affected": "315",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74541",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74541.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.