CVE-2026-74541
Description
A flaw was found in the Linux kernel's Bluetooth ISO subsystem. This vulnerability arises from the system's failure to properly clear iso_data when a connection is detached from its host controller connection (hcon). A local attacker could exploit this use-after-free condition to cause a denial of service or potentially achieve arbitrary code execution.
Statement
This vulnerability is rated Moderate impact because successful exploitation requires local unprivileged access on systems equipped with functional Bluetooth hardware to trigger the improper socket resource deallocation. Enterprise server deployments typically do not utilize Bluetooth controllers, significantly limiting general exposure across default environments. Although memory corruption could theoretically allow privilege escalation or cause a denial of service through a system crash, exploitation is constrained by complex timing requirements during connection termination.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 8.8 |
| Attack Vector | Local | N/A | Adjacent Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
