What’s Vulnerable › Vulnerabilities

CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-15 · updated 2026-10-21

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_connect_ind Accessing iso_pi(sk)->conn requires lock_sock, which is not taken in the "ev3" part of iso_connect_ind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before locking. Fix by adding lock/release. Recheck hcon is valid after lock acquire where needed.

Affected products

• Linux kernel: from 6.8.9 before 6.9; 6.9 — fixed in 6.9, 7.2

How to fix

Upgrade to a fixed version: Linux kernel 6.9, 7.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0e830354c120954ccb9ca15880245912722c4031
• https://git.kernel.org/stable/c/4311fd6f429065a8ba208660360a895627a00cf3
• https://git.kernel.org/stable/c/9bee7e476534f27e830658dad962d85da9edf6bf
• https://git.kernel.org/stable/c/e8e9cff6d80eeec28dec4cf7cc18662986945391

Get alerted when CVE-2026-74538 or the next vulnerability affects your stack