Linux Kernel CVE-2026-74537

Bluetooth must be enabled and the kernel must include Bluetooth ISO (isochronous channel) support compiled in - systems built without CONFIG_BT_LE_ISO, or with Bluetooth physically absent or rfkill-blocked, are not affected. A local application must have opened at least one AF_BLUETOOTH / BTPROTO_ISO socket and be in the process of closing it via iso_sock_release() concurrently with an externally-initiated ISO connection - meaning a victim process running Bluetooth LE Audio or a similar ISO-consuming application must be actively tearing down a connection at the moment of the attack. The exploitable race window is narrow: the attacker's incoming ISO connection must reach iso_conn_ready() after conn->sk is read but before lock_sock() is acquired on the teardown thread, requiring either precise timing or high-frequency repeated attempts. The Adjacent attack vector (CVSS AV:A) restricts exploitation to Bluetooth proximity - typically 10 to 100 meters depending on hardware class. Per the CVSS PR:N rating, no Bluetooth authentication or pairing is required from the attacker to initiate an ISO connection attempt against the target.

The NVD CVSS score of 8.8 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the theoretical severity of kernel-level UAF exploitation via an adjacent Bluetooth attacker requiring no authentication. However, multiple signals substantially temper real-world priority. EPSS at 0.17% (6th percentile) indicates very low exploitation probability relative to all known CVEs. No CISA KEV entry and no public POC exist. The AC:L rating in the provided vector arguably understates difficulty: reliably winning the narrow race between two concurrent kernel threads requires timing precision that typically elevates practical exploitation complexity - independent assessment warrants AC:H. The Adjacent attack vector (Bluetooth range, typically 10-100 meters) eliminates internet-scale exploitation entirely, restricting realistic threat actors to those with physical or near-physical proximity. Real-world priority is highest for mobile Linux platforms, IoT devices running LE Audio stacks, and desktop systems with Bluetooth ISO actively in use in accessible environments; servers and systems with Bluetooth disabled have zero exposure.

An attacker within Bluetooth range of a target running a vulnerable Linux kernel - such as a laptop or IoT device using LE Audio - repeatedly sends ISO connection requests while the victim device is actively cycling Bluetooth ISO sockets open and closed (as an LE Audio application would during normal operation). By timing incoming ISO connection processing in iso_conn_ready() to overlap precisely with a concurrent iso_sock_release() call, the attacker causes the freed socket structure to be dereferenced, potentially overwriting kernel memory to achieve privilege escalation to root or inducing a kernel panic. No public POC is available at time of analysis, making reliable weaponization non-trivial without significant kernel-level exploit development effort.