# CVE-2026-74534: Bluetooth: ISO: fix refcounting of iso_conn

> A race condition in the Linux kernel Bluetooth ISO subsystem causes a use-after-free, potentially allowing local attackers to execute code or escalate privileges.

- **Severity:** High 8.8 (`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 15 Aug 2026
- **Updated:** 23 Oct 2026
- **Also known as:** BELL-CVE-2026-74534, DEBIAN-CVE-2026-74534, GHSA-f45g-2gpw-92wg, UBUNTU-CVE-2026-74534

## What is CVE-2026-74534?

CVE-2026-74534 is a high-severity use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: fix refcounting of iso_conn

iso_conn_del() and iso_chan_del() have a race that results to double-put
of iso_conn:

    [Task hdev->workqueue]         [Task 2]
    iso_conn_del                   iso_chan_del
      iso_conn_hold_unless_zero      iso_conn_lock
      iso_conn_lock                  conn->sk = NULL
                                     iso_conn_unlock
      sk = iso_sock_hold(conn)  <---------´
      if (!sk) iso_conn_put          iso_conn_put
      iso_conn_put /* UAF */

The extra put for !sk in iso_conn_del() is currently required since
failing iso_chan_add() may leave iso_conn not associated with any sk.

Fix by having iso_pi(sk)->conn own refcount when non-NULL, so
iso_conn_del does not need to put it.  Adjust the iso_conn_add()
refcounting so that conn is put if it does not get associated with an
sk.

## Which versions are affected by CVE-2026-74534?


## How do I fix CVE-2026-74534?

Apply the vendor's patch.

## Is CVE-2026-74534 being exploited?

There is no known exploitation of CVE-2026-74534 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-74534 and fix it if it is affected.

What it is: CVE-2026-74534 is a high-severity use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-74534 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-74534/ (Markdown: https://insights.sbomify.com/CVE-2026-74534/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-74534
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-74534
- OSV: https://osv.dev/vulnerability/CVE-2026-74534

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-74534/
Summaries are generated and may contain mistakes; the official description above is the record.