CVE-2026-74538 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: lock sk in iso_connect_ind
Accessing iso_pi(sk)->conn requires lock_sock, which is not taken in the "ev3" part of iso_connect_ind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before locking.
Fix by adding lock/release. Recheck hcon is valid after lock acquire where needed.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Linux kernel's Bluetooth implementation, specifically in the ISO (Individual Socket Option) subsystem where the iso_connect_ind function handles connection indication events. The flaw stems from improper synchronization mechanisms during socket state transitions, creating a potential race condition that could lead to memory corruption or privilege escalation. The issue manifests when processing the "ev3" portion of the connection indication handler where code attempts to access the conn member of the iso_pi structure without proper locking mechanisms.
The technical root cause involves the iso_pi(sk)->conn pointer access pattern within the iso_connect_ind function. When the Bluetooth subsystem processes incoming connection indications, it must navigate through various socket states including LISTEN and CONNECT states. The vulnerability occurs because the code fails to acquire the necessary socket lock before accessing the conn field, which can result in accessing a NULL pointer or corrupted memory structure if the socket state has changed between the time of initial check and actual access. This particular race condition represents a classic concurrency flaw where insufficient locking allows for inconsistent state access during multi-threaded operations.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially enable privilege escalation within the kernel space. Attackers could exploit this race condition by carefully timing socket state transitions to trigger the unsafe access pattern, potentially leading to denial of service conditions or unauthorized code execution in kernel context. The vulnerability affects systems running Linux kernels with Bluetooth ISO functionality enabled, particularly those handling concurrent Bluetooth connections where multiple threads might be processing connection events simultaneously.
Security mitigations for this vulnerability require implementing proper locking mechanisms around all accesses to socket connection structures within the iso_connect_ind function. The fix involves adding explicit lock_sock and release_sock calls before accessing iso_pi(sk)->conn, ensuring that socket state remains consistent during the critical section. Additionally, proper validation of hcon pointers should be performed after acquiring locks to verify that the connection object is still valid and has not been freed or transitioned to an invalid state. This approach aligns with standard kernel security practices for concurrent access control and follows established patterns for preventing race conditions in network subsystem implementations. The solution addresses CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and supports ATT&CK technique T1068 (Exploitation for Privilege Escalation) by preventing unauthorized kernel memory access patterns.