https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 01:49:04 +0000 https://vulnerability.circl.lu/vuln/cve-2026-74537 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: ISO: hold sk properly in iso_conn_ready</p> <p>sk deref in iso_conn_ready must be done either under conn-&gt;lock, or holding a refcount, to avoid concurrent close. conn-&gt;sk is currently accessed without either:</p> <p>[Task 1] [Task 2] iso_sock_release iso_conn_ready sk = conn-&gt;sk lock_sock(sk) conn-&gt;sk = NULL lock_sock(sk) release_sock(sk) iso_sock_kill(sk) UAF on sk deref</p> <p>Fix possible UAF by holding sk refcount in iso_conn_ready(). Also recheck after lock_sock that the socket is still valid. Adjust locking so conn-&gt;sk is cleared only under lock_sock.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: ISO: hold sk properly in iso_conn_ready</p> <p>sk deref in iso_conn_ready must be done either under conn-&gt;lock, or holding a refcount, to avoid concurrent close. conn-&gt;sk is currently accessed without either:</p> <p>[Task 1] [Task 2] iso_sock_release iso_conn_ready sk = conn-&gt;sk lock_sock(sk) conn-&gt;sk = NULL lock_sock(sk) release_sock(sk) iso_sock_kill(sk) UAF on sk deref</p> <p>Fix possible UAF by holding sk refcount in iso_conn_ready(). Also recheck after lock_sock that the socket is still valid. Adjust locking so conn-&gt;sk is cleared only under lock_sock.</p> https://vulnerability.circl.lu/vuln/cve-2026-74537