CVE-2026-74534

The CVSS 8.8 score for CVE-2026-74534 obscures more than it reveals. This is not a missing unlock or a straightforward use-after-free — it's a semantic failure in reference ownership that made the race invisible during code review. The vulnerability involves a race between iso_conn_del() running in workqueue context and a concurrent iso_chan_del() call. The critical detail is that iso_chan_del() clears conn->sk while iso_conn_del() is mid-flight, having already called iso_conn_hold_unless_zero(). This creates a double-put when the conditional logic in iso_conn_del() executes its legacy branch designed to handle failed iso_chan_add() cases. The workqueue context isn't just an implementation detail — it explains why this bug persisted for years. The race window is narrow enough that normal testing never aligned the async callbacks, so the flaw was effectively invisible despite years of review. The fix does something more ambitious than patching a missing operation: it restructures who owns the reference when iso_pi(sk)->conn is non-NULL. The conditional put that caused the double-put is removed because the new semantics declare that iso_pi(sk)->conn owns its own reference outright. This eliminates the contextual reasoning developers had to do — remembering whether iso_chan_add() might have failed and left conn unattached. That contextual knowledge existed nowhere in the type system or function signatures, only as tribal knowledge encoded in the conditional put itself. What should concern analysts most is the blast radius of this semantic restructuring. The old conditional put was a shock absorber: it tolerated paths where iso_pi(sk)->conn association failed or was incomplete. Those failure paths still exist in the kernel — they're documented operational states that hardware, the HCI layer, or userspace can trigger. The fix implicitly asserts those conditions no longer matter, without enumerating which code paths might still hit them. Every caller that sets iso_pi(sk)->conn now needs to match the new mental model exactly, or silent reference leaks will surface in unrelated code paths under unusual load. This fits a pattern visible across the Bluetooth subsystem: reference ownership bugs in connection lifecycle transitions share a common genetic sequence. The HCI connection teardown went through an identical refactoring three years ago. Each restructuring fixes the local bug but shifts the implicit contract that out-of-tree drivers, vendor backports, and stable trees depend on. The severity score treats this as a point-in-time vulnerability, but the systemic risk is cumulative — every semantic restructuring trades one implicit failure mode for another, and the next reference counting bug is already being written in code paths that haven't been audited.

Reviewed through automated stages and approved by a human before publication.