Skip to main content

Linux Kernel CVE-2026-74537

| EUVDEUVD-2026-59730 HIGH
2026-08-15 Linux GHSA-4f56-g5vg-w2cg
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Race condition timing requirement elevates AC to H over the provided AC:L; Adjacent Bluetooth vector, unauthenticated initiation, and full kernel-level impact on C/I/A are otherwise unchanged.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:15 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: hold sk properly in iso_conn_ready

sk deref in iso_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either:

[Task 1] [Task 2] iso_sock_release iso_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) iso_sock_kill(sk) UAF on sk deref

Fix possible UAF by holding sk refcount in iso_conn_ready(). Also recheck after lock_sock that the socket is still valid. Adjust locking so conn->sk is cleared only under lock_sock.

AnalysisAI

Use-after-free race condition in the Linux kernel's Bluetooth ISO subsystem allows an unauthenticated attacker within Bluetooth adjacency range to corrupt kernel memory by exploiting concurrent socket teardown in iso_conn_ready(), potentially leading to privilege escalation or system crash on affected hosts. The flaw - present since the introduction of Bluetooth 5.2 ISO channel support in Linux 5.15 - arises because conn->sk is dereferenced without holding a lock or refcount, enabling a concurrent iso_sock_release() call to free the socket before iso_conn_ready() completes its dereference. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Enter Bluetooth adjacency range
Delivery
Identify target with ISO socket active
Exploit
Send repeated ISO connection requests
Execution
Race iso_conn_ready against victim iso_sock_release
Persist
Trigger use-after-free on freed sk dereference
Impact
Corrupt kernel heap to escalate privileges or crash system
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Bluetooth must be enabled and the kernel must include Bluetooth ISO (isochronous channel) support compiled in - systems built without CONFIG_BT_LE_ISO, or with Bluetooth physically absent or rfkill-blocked, are not affected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD CVSS score of 8.8 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the theoretical severity of kernel-level UAF exploitation via an adjacent Bluetooth attacker requiring no authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker within Bluetooth range of a target running a vulnerable Linux kernel - such as a laptop or IoT device using LE Audio - repeatedly sends ISO connection requests while the victim device is actively cycling Bluetooth ISO sockets open and closed (as an LE Audio application would during normal operation). By timing incoming ISO connection processing in iso_conn_ready() to overlap precisely with a concurrent iso_sock_release() call, the attacker causes the freed socket structure to be dereferenced, potentially overwriting kernel memory to achieve privilege escalation to root or inducing a kernel panic. …
Remediation Upgrade to Linux 6.18.44, 7.1.8, or 7.2-rc6 (or any later release), which incorporate fix commits 4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5, 1308d72903d792d10b82bc4ef08b8a4452308b04, and 0d255e63fcf3f13a570d7ac11678fa1164ac015c respectively, available from the kernel stable tree at https://git.kernel.org/stable/c/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Linux systems with Bluetooth ISO support (Linux kernel 5.15 or later) and confirm patch availability from your Linux distribution vendor. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-74537 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy