Skip to main content

Linux Kernel CVE-2026-74534

| EUVDEUVD-2026-59727 HIGH
2026-08-15 Linux GHSA-f45g-2gpw-92wg
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

AV:A confirmed by Bluetooth proximity requirement; AC:H reflects race condition timing dependency not captured in the provided AC:L; PR:N and full C/I/A impact retained given potential kernel UAF reach.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:13 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: fix refcounting of iso_conn

iso_conn_del() and iso_chan_del() have a race that results to double-put of iso_conn:

[Task hdev->workqueue] [Task 2] iso_conn_del iso_chan_del iso_conn_hold_unless_zero iso_conn_lock iso_conn_lock conn->sk = NULL iso_conn_unlock sk = iso_sock_hold(conn) <---------´ if (!sk) iso_conn_put iso_conn_put iso_conn_put /* UAF */

The extra put for !sk in iso_conn_del() is currently required since failing iso_chan_add() may leave iso_conn not associated with any sk.

Fix by having iso_pi(sk)->conn own refcount when non-NULL, so iso_conn_del does not need to put it. Adjust the iso_conn_add() refcounting so that conn is put if it does not get associated with an sk.

AnalysisAI

Use-after-free via reference counting race in the Linux kernel's Bluetooth ISO (LE Audio) subsystem allows an adjacent, unauthenticated attacker to potentially achieve kernel-level code execution or information disclosure. The race arises between concurrent execution of iso_conn_del() and iso_chan_del() in separate kernel tasks, resulting in a double-put of the iso_conn object and subsequent memory corruption. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Position within Bluetooth range
Delivery
Initiate ISO BT connection to target
Exploit
Trigger rapid teardown sequence
Execution
Win refcount race between iso_conn_del and iso_chan_del
Persist
Exploit kernel use-after-free
Impact
Execute code with kernel privileges
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target system to be running an unpatched Linux kernel in the affected version ranges (6.11.11-pre-6.12, 6.12.2-pre-6.13, or the specific 6.13 commit range). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD CVSS 8.8 score (AV:A/AC:L/PR:N/UI:N) overstates practical exploitability: the 'adjacent' attack vector confines exploitation to Bluetooth RF proximity, ruling out internet-scale mass exploitation, and the race condition inherently demands precise timing across two kernel execution contexts - a complexity factor that AC:L fails to capture. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker within Bluetooth radio range of a target system running an affected Linux kernel establishes an ISO Bluetooth connection and then crafts a rapid connection-teardown sequence designed to trigger concurrent execution of iso_conn_del() on the kernel workqueue and iso_chan_del() in a separate task. If the race window is hit, the iso_conn object is freed twice; with sufficient heap control or spray primitives, the attacker may reclaim the freed memory with attacker-controlled data to redirect kernel execution. …
Remediation The primary remediation is to upgrade to a patched kernel release: Linux 6.18.44 or 7.1.8 for production stable branches, or 7.2-rc6 for testing. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all systems running Linux kernel versions 6.11.11 through pre-6.13 series with Bluetooth or LE Audio services enabled, and assess exposure to Bluetooth-adjacent networks. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-74534 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy