CVE-2026-74535

This vulnerability is a use-after-free in the Linux kernel's Bluetooth ISO stack that exposes a structural failure in how timers and connection objects interact across different synchronization domains. The bug manifests when `iso_conn_del()` running on a workqueue races with the socket timeout handler — both attempt to manage the same connection object's lifecycle, but `lock_sock` (the synchronization barrier for socket operations) provides no protection against workqueue-based async operations that touch the underlying connection. The timer was placed on `iso_conn` under the intuitive assumption that the connection would outlive the timer, but this assumption wasn't enforced by the code paths themselves. The fix moves the timer from `iso_conn` to `iso_pinfo`, which is an architectural correction rather than a simple patch — it removes the temporal coupling entirely rather than patching around it. However, note that this relocates rather than eliminates the coupling problem: the timer's ownership semantics now live in a different object, and the fundamental question of whether `iso_pinfo` has guaranteed lifetime superiority over `iso_conn` in all code paths requires independent verification. The deeper problem is that the kernel timer API deliberately refuses to enforce ownership semantics — it provides `timer_setup` and `timer_shutdown` for mechanism, not model. Every subsystem invents its own ownership pattern on top of a flat API, and this underspecification has produced a documented recurrence cycle: timer-relocation fixes in USB, network drivers, and Bluetooth HCI over the past decade all follow the same migration pattern. The kernel keeps patching the symptom at specific call sites while the API continues to enable the pattern. For defenders: audit any code path where timers reference objects that can be freed from workqueue contexts. The presence of `lock_sock` is insufficient protection — explicitly verify that timer callbacks and async deletion paths operate on objects with proven lifetime ordering. Assume this class of bug will recur in new contexts; treat each timer relocation as a signal to audit the new owner object's destruction sequence.

Reviewed through automated stages and approved by a human before publication.