Skip to main content

Linux Kernel CVE-2026-74541

| EUVDEUVD-2026-59734 HIGH
2026-08-15 Linux GHSA-jwr7-m8vx-rqm4
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Adjacent vector reflects Bluetooth radio-proximity requirement; no local privileges needed since remote device drives the connection abort that triggers the UAF.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:18 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: clear iso_data always when detaching conn from hcon

When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is necessary, otherwise later iso_conn_free() will UAF.

Fix clearing of iso_data in iso_sock_disconn()

Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on iso_sock_release() followed by hci_abort_conn_sync().

AnalysisAI

Use-after-free in the Linux kernel Bluetooth ISO subsystem allows a physically adjacent, unauthenticated attacker to corrupt kernel heap memory, potentially enabling privilege escalation or a denial-of-service crash. The defect exists in iso_sock_disconn(), where clearing conn->hcon = NULL omits the required conn->hcon->iso_data = NULL reset, leaving a dangling pointer that iso_conn_free() later dereferences. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Move within Bluetooth radio range
Delivery
Initiate Bluetooth ISO connection to target
Exploit
Trigger remote HCI connection abort
Execution
Hit dangling iso_data pointer in iso_conn_free()
Persist
Corrupt kernel slab heap
Impact
Leverage heap corruption for privilege escalation or crash
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Bluetooth hardware must be present and not rfkill-blocked on the target system. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The official CVSS 3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately captures the theoretical severity of a kernel heap UAF reachable from adjacent Bluetooth range without local authentication, with high CIA impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker within Bluetooth radio range (~10 meters) of a Linux system running a LE Audio or Bluetooth 5.2 ISO workload pairs with the target and establishes a Bluetooth Isochronous channel. The attacker then sends a crafted HCI-level disconnect or abort, triggering `hci_abort_conn_sync()` against a socket that the local kernel has partially torn down via `iso_sock_release()`, hitting the dangling `iso_data` pointer in `iso_conn_free()` and corrupting a kernel heap slab. …
Remediation Upgrade to a patched kernel version from the appropriate stable branch: 6.6.151 or later, 6.12.103 or later, 6.18.44 or later, 7.1.8 or later, or 7.2-rc6 or later. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Immediately inventory all Linux systems running kernel versions prior to 6.6.151, 6.12.103, 6.18.44, or 7.1.8, with emphasis on identifying which have Bluetooth ISO enabled and reside in locations permitting physical attacker proximity. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-74541 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy