GHSA-8VQW-G268-Q22J
Vulnerability from github – Published: 2026-08-15 15:30 – Updated: 2026-08-15 15:30In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: fix leaking sk after socket release
iso_sock_kill() tests !sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket || sock_flag(sk, SOCK_DEAD) for early return, but this is always true since sock_orphan(sk) sets SOCK_DEAD, so the sk reference released by socket always leaks, iso_sock_destruct is never called.
The socket reference also leaks when __iso_sock_close() does not set SOCK_ZAPPED, since iso_conn_del() does not call iso_sock_kill() after zapping.
Fix by replacing SOCK_DEAD by BT_SK_KILLED flag that is not used for something else, and lock_sock to ensure iso_sock_kill() puts sk only after socket release only once. Release and iso_conn_del may run concurrently. Call iso_sock_kill() from iso_conn_del() to clean sk up after zapping.
Remove call to iso_sock_kill() from iso_sock_close(), as it's generally no-op there.
{
"affected": [],
"aliases": [
"CVE-2026-74536"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-15T13:17:58Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix leaking sk after socket release\n\niso_sock_kill() tests !sock_flag(sk, SOCK_ZAPPED) || sk-\u003esk_socket ||\nsock_flag(sk, SOCK_DEAD) for early return, but this is always true since\nsock_orphan(sk) sets SOCK_DEAD, so the sk reference released by socket\nalways leaks, iso_sock_destruct is never called.\n\nThe socket reference also leaks when __iso_sock_close() does not set\nSOCK_ZAPPED, since iso_conn_del() does not call iso_sock_kill() after\nzapping.\n\nFix by replacing SOCK_DEAD by BT_SK_KILLED flag that is not used for\nsomething else, and lock_sock to ensure iso_sock_kill() puts sk only\nafter socket release only once. Release and iso_conn_del may run\nconcurrently. Call iso_sock_kill() from iso_conn_del() to clean sk up\nafter zapping.\n\nRemove call to iso_sock_kill() from iso_sock_close(), as it\u0027s generally\nno-op there.",
"id": "GHSA-8vqw-g268-q22j",
"modified": "2026-08-15T15:30:35Z",
"published": "2026-08-15T15:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74536"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/96ed3c772c08e7a91c399567f412618e43231023"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ce57442a379212fe3fda59c9437ee8217eceb5b1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e30e5ca63c8fbe3cd505fbb419bb547760cda633"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e76a0ae6542ae43241b2147bacf4990e7ae5316a"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.