{"id":"CVE-2026-74536","summary":"Bluetooth: ISO: fix leaking sk after socket release","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix leaking sk after socket release\n\niso_sock_kill() tests !sock_flag(sk, SOCK_ZAPPED) || sk-\u003esk_socket ||\nsock_flag(sk, SOCK_DEAD) for early return, but this is always true since\nsock_orphan(sk) sets SOCK_DEAD, so the sk reference released by socket\nalways leaks, iso_sock_destruct is never called.\n\nThe socket reference also leaks when __iso_sock_close() does not set\nSOCK_ZAPPED, since iso_conn_del() does not call iso_sock_kill() after\nzapping.\n\nFix by replacing SOCK_DEAD by BT_SK_KILLED flag that is not used for\nsomething else, and lock_sock to ensure iso_sock_kill() puts sk only\nafter socket release only once. Release and iso_conn_del may run\nconcurrently. Call iso_sock_kill() from iso_conn_del() to clean sk up\nafter zapping.\n\nRemove call to iso_sock_kill() from iso_sock_close(), as it's generally\nno-op there.","modified":"2026-08-18T03:31:07.722177707Z","published":"2026-08-15T12:27:49.054Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74536.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/96ed3c772c08e7a91c399567f412618e43231023"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ce57442a379212fe3fda59c9437ee8217eceb5b1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e30e5ca63c8fbe3cd505fbb419bb547760cda633"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e76a0ae6542ae43241b2147bacf4990e7ae5316a"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74536.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74536"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ccf74f2390d60a2f9a75ef496d2564abb478f46a"},{"fixed":"96ed3c772c08e7a91c399567f412618e43231023"},{"fixed":"e76a0ae6542ae43241b2147bacf4990e7ae5316a"},{"fixed":"e30e5ca63c8fbe3cd505fbb419bb547760cda633"},{"fixed":"ce57442a379212fe3fda59c9437ee8217eceb5b1"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74536.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.12.103"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.44"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.8"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74536.json"}}],"schema_version":"1.9.0"}