{"id":8824,"date":"2026-09-04T18:50:05","date_gmt":"2026-09-04T10:50:05","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74535-2"},"modified":"2026-09-04T18:50:05","modified_gmt":"2026-09-04T10:50:05","slug":"cve-2026-74535-2","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74535-2","title":{"rendered":"CVE-2026-74535 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: avoid"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>Bluetooth: ISO: avoid deadlocks in iso_sock_timeout<\/p>\n<p>iso_sock_timeout() takes lock_sock, so sync disabling the timer while<br \/>\nholding that lock may deadlock.<\/p>\n<p>iso_sock_timeout() may also run concurrently with iso_conn_del(), which<br \/>\nleads to UAF<\/p>\n<p>        [Task 1]                      [Task hdev-&gt;workqueue]<br \/>\n        iso_sock_timeout              iso_conn_del<br \/>\n          iso_conn_hold_unless_zero     iso_chan_del<br \/>\n                           `&#8212;&#8212;&#8212;&#8212;&gt; iso_conn_put<br \/>\n                                      caller frees hcon<br \/>\n          iso_conn_put<br \/>\n            iso_conn_free<br \/>\n              conn-&gt;hcon-&gt;iso_data = NULL; \/* UAF *\/<\/p>\n<p>Fix the deadlock by removing the disable from the lock_sock sections.<br \/>\nMove the timer from iso_conn to iso_pinfo to decouple it from iso_conn<br \/>\nwhich may need to be freed in lock_sock section. Convert some of the<br \/>\nclear_timer to disable_timer.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>Bluetooth: ISO: avoid deadlocks in iso_sock_timeout<\/p>\n<p>iso_sock_timeout() takes lock_sock, so sync disabling the timer while<br \/>\nholding <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-8824","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/8824","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8824"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8824"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8824"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}