Skip to main content

Linux Kernel CVE-2026-74535

| EUVDEUVD-2026-59728 HIGH
2026-08-15 Linux GHSA-m6r7-j582-3j5f
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

AV:A reflects Bluetooth proximity constraint; AC elevated to H because exploiting a kernel concurrency race requires precise timing beyond AC:L.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:14 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: avoid deadlocks in iso_sock_timeout

iso_sock_timeout() takes lock_sock, so sync disabling the timer while holding that lock may deadlock.

iso_sock_timeout() may also run concurrently with iso_conn_del(), which leads to UAF

[Task 1] [Task hdev->workqueue] iso_sock_timeout iso_conn_del iso_conn_hold_unless_zero iso_chan_del `------------> iso_conn_put caller frees hcon iso_conn_put iso_conn_free conn->hcon->iso_data = NULL; /* UAF */

Fix the deadlock by removing the disable from the lock_sock sections. Move the timer from iso_conn to iso_pinfo to decouple it from iso_conn which may need to be freed in lock_sock section. Convert some of the clear_timer to disable_timer.

AnalysisAI

Concurrent deadlock and use-after-free (UAF) vulnerabilities in the Linux kernel's Bluetooth ISO socket layer allow adjacent-network attackers to corrupt kernel memory via race conditions in iso_sock_timeout(). Affected systems must be within Bluetooth radio range; no authentication is required. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Enter Bluetooth radio adjacency
Delivery
Initiate ISO Bluetooth connection to target
Exploit
Trigger concurrent socket timeout and connection teardown
Execution
Race iso_sock_timeout against iso_conn_del on hdev->workqueue
Persist
Dereference freed hcon memory (UAF)
Impact
Achieve kernel heap corruption or disclosure
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target kernel must have Bluetooth ISO socket support compiled in (`CONFIG_BT_LE` and ISO socket path enabled) and Bluetooth must be active on the system. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 8.8 score and C:H/I:H/A:H impact vector represent a theoretical worst case for a kernel UAF, but real-world priority should be tempered by several factors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a Bluetooth-capable device positions themselves within radio range of a vulnerable Linux system, establishes an ISO Bluetooth channel, then deliberately interleaves connection teardown with socket timeout expiry to race the concurrent execution paths in `iso_conn_del` and `iso_sock_timeout`. If the race is won, the freed `hcon` structure's `iso_data` pointer is dereferenced, enabling potential kernel heap read or write primitives. …
Remediation Upgrade to a patched kernel release: 6.12.103 for the 6.12.x stable series, 7.1.8 for the 7.1.x series, or incorporate the 7.2-rc6 fix for pre-release branches. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Linux systems with Bluetooth capabilities and obtain patch information from your distribution vendor (Red Hat, Canonical, SUSE, Ubuntu, etc.). …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-74535 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy