Skip to main content

Linux Kernel CVE-2026-74533

| EUVDEUVD-2026-59726 HIGH
2026-08-15 Linux GHSA-xf88-xmxw-hhch
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

AV:A reflects Bluetooth-only adjacency; AC:H corrects the supplied AC:L because race condition exploitation is inherently timing-dependent and unreliable, not low-complexity.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 HIGH
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:12 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero

hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race

[Task hdev->workqueue] [Task 2] iso_recv iso_conn_put(conn) conn = LOAD hcon->iso_data iso_conn_free(conn) iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL kfree(conn) kref_get_unless_zero(&conn->ref) /* UAF */

and also to races in iso_conn_add() vs. iso_conn_free().

Fix by adding spinlock hci_conn::proto_lock and using it to guard hci_conn::iso_data.

AnalysisAI

Use-after-free race condition in the Linux kernel Bluetooth ISO subsystem allows an adjacent, unauthenticated attacker to trigger kernel memory corruption with full confidentiality, integrity, and availability impact. The flaw resides in the hci_conn::iso_data field, which is read and modified across concurrent kernel tasks without lock or RCU protection - allowing a kfree() in one task to race against a kref_get_unless_zero() in another, yielding a dangling pointer dereference. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Enter Bluetooth radio range of target
Delivery
Initiate repeated Bluetooth ISO connections
Exploit
Trigger iso_recv processing on hdev->workqueue
Install
Simultaneously induce ISO connection teardown via iso_conn_put
C2
Win kfree vs kref_get_unless_zero race window
Execute
Dereference freed hci_conn::iso_data
Impact
Kernel UAF for code execution or denial of service
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must be within Bluetooth radio range of the target system (AV:A - not exploitable remotely over IP). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The supplied CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H produces a score of 8.8, but the AC:L designation is analytically inconsistent with the race condition nature of this flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker positions themselves within Bluetooth radio range of a target Linux system running an affected kernel with Bluetooth ISO channels active. By repeatedly initiating and tearing down Bluetooth ISO connections, the attacker drives high-frequency concurrent execution of the iso_recv and iso_conn_put paths in the kernel. …
Remediation Apply the upstream kernel stable patches available at https://git.kernel.org/stable/c/876a3e94c70d0859d1dad1c986112d4f0d99eba8 and https://git.kernel.org/stable/c/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c, which introduce hci_conn::proto_lock to serialize access to hci_conn::iso_data; downstream distribution kernel package updates should be applied as they publish. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit all Linux systems for Bluetooth ISO subsystem presence using kernel configuration checks and bluetoothctl enumeration; disable Bluetooth ISO on non-critical systems via kernel module blacklist (echo 'blacklist iso' >> /etc/modprobe.d/bluetooth.conf on Debian-based systems) as interim protection. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-74533 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy