CVE-2026-74541 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: clear iso_data always when detaching conn from hcon
When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is necessary, otherwise later iso_conn_free() will UAF.
Fix clearing of iso_data in iso_sock_disconn()
Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on iso_sock_release() followed by hci_abort_conn_sync().
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Linux kernel's Bluetooth subsystem, specifically affecting the ISO (Individual Stream Option) protocol implementation. The issue stems from improper memory management during connection detachment operations, creating a use-after-free condition that can lead to system instability or potential exploitation. The flaw occurs when a Bluetooth connection is being disconnected and the associated iso_data structure is not properly cleared before the connection handle is set to NULL. This creates a scenario where the iso_conn_free() function attempts to access memory that has already been freed, resulting in a kernel memory corruption vulnerability.
The technical root cause involves a race condition and improper resource cleanup in the Bluetooth ISO socket implementation. When conn->hcon is set to NULL during disconnection, the associated iso_data pointer within the connection structure remains pointing to freed memory. This violates fundamental memory safety principles and creates opportunities for attackers to exploit the use-after-free condition through carefully crafted Bluetooth operations. The vulnerability manifests as a slab-use-after-free error reported by KASAN (Kernel Address Sanitizer), indicating that kernel memory objects are being accessed after they have been freed from the kernel's memory management system.
The operational impact of this vulnerability extends beyond simple memory corruption, potentially allowing for privilege escalation or denial of service attacks within systems running affected Linux kernels. Attackers could leverage this condition to execute arbitrary code in kernel space, particularly when Bluetooth ISO connections are actively managed through socket operations. The vulnerability is especially concerning in embedded systems, IoT devices, and mobile platforms where Bluetooth functionality is prevalent and kernel-level exploits can have severe consequences for system integrity and security posture.
Mitigation strategies should focus on implementing proper memory management practices within the kernel's Bluetooth subsystem, ensuring that all pointers are cleared before objects are freed from memory. The fix requires modifying the iso_sock_disconn() function to explicitly clear the iso_data pointer when detaching connections from hcon structures. System administrators should prioritize updating to patched kernel versions that address this specific vulnerability, while security teams should monitor for exploitation attempts targeting Bluetooth ISO protocol implementations. This vulnerability aligns with CWE-416 (Use After Free) and can be mapped to ATT&CK technique T1059.007 (Command and Scripting Interpreter: PowerShell) through potential exploitation vectors involving kernel-level command execution. Organizations should implement comprehensive patch management processes specifically targeting kernel security updates, as this vulnerability affects the core operating system functionality rather than application-layer components.