{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-74535 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-74535 is a high-severity use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-74535 and fix it if it is affected.\n\nWhat it is: CVE-2026-74535 is a high-severity use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-74535 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-74535/ (Markdown: https://insights.sbomify.com/CVE-2026-74535/index.md)","id":"CVE-2026-74535","markdown":"https://insights.sbomify.com/CVE-2026-74535/index.md","name":"CVE-2026-74535","record":{"aliases":["BELL-CVE-2026-74535","DEBIAN-CVE-2026-74535","GHSA-m6r7-j582-3j5f","UBUNTU-CVE-2026-74535"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel Bluetooth","requires_auth":"none","summary":"A use-after-free vulnerability in the Linux kernel's Bluetooth ISO subsystem allows attackers to cause a denial of service or potentially execute code via concurrent operations.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: avoid deadlocks in iso_sock_timeout\n\niso_sock_timeout() takes lock_sock, so sync disabling the timer while\nholding that lock may deadlock.\n\niso_sock_timeout() may also run concurrently with iso_conn_del(), which\nleads to UAF\n\n        [Task 1]                      [Task hdev-\u003eworkqueue]\n        iso_sock_timeout              iso_conn_del\n          iso_conn_hold_unless_zero     iso_chan_del\n                           `------------\u003e iso_conn_put\n                                      caller frees hcon\n          iso_conn_put\n            iso_conn_free\n              conn-\u003ehcon-\u003eiso_data = NULL; /* UAF */\n\nFix the deadlock by removing the disable from the lock_sock sections.\nMove the timer from iso_conn to iso_pinfo to decouple it from iso_conn\nwhich may need to be freed in lock_sock section. Convert some of the\nclear_timer to disable_timer.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Bluetooth: ISO: avoid deadlocks in iso_sock_timeout","id":"CVE-2026-74535","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"Bluetooth: ISO: fix leaking sk after socket release","id":"CVE-2026-74536"},"packages":[],"prev":{"headline":"Bluetooth: ISO: fix refcounting of iso_conn","id":"CVE-2026-74534"},"products":["Linux"],"published":"2026-08-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-16","vendors":["Linux"]},"summary":"A use-after-free vulnerability in the Linux kernel's Bluetooth ISO subsystem allows attackers to cause a denial of service or potentially execute code via concurrent operations.","url":"https://insights.sbomify.com/CVE-2026-74535/"}