CVE-2026-74537

CVE-2026-74537 is a use-after-free in the Linux kernel's Bluetooth ISO connection handling where accessing conn->sk without proper synchronization allows a race between dereferencing the socket pointer and the socket being freed by a concurrent path. The vulnerability manifests because iso_conn_ready() appears correct—it retrieves sk from conn->sk and immediately calls lock_sock(sk)—but the window between the dereference and the lock acquisition is sufficient for another thread to clear conn->sk and destroy the socket. The fix requires three coordinated changes: holding a refcount on the socket before accessing it, rechecking socket validity after acquiring the lock, and ensuring conn->sk is cleared only under lock_sock protection. This three-part remediation is itself diagnostic—it reveals that the original code looked correct in isolation but was wrong under real concurrency. The conn->sk accessor pattern creates a semantically misleading 'safe at a glance' abstraction that lulls kernel developers into incorrect assumptions about concurrency safety. The immediate action is to verify that any code path dereferencing conn->sk holds either conn->lock or a socket refcount before the access. Check iso_conn_ready() and audit all other call sites in the Bluetooth ISO path for the same pattern. The broader remediation is that the kernel should provide a safe accessor macro or function for conn->sk that encapsulates the refcount + validity check, making correct usage the path of least resistance rather than relying on developer vigilance. This isn't an isolated coding error—it's a systemic API design failure. The conn->sk field appears to be a straightforward socket pointer, but the kernel provides no mechanism to make correct usage mandatory. Until the API itself is hardened with embedded refcount semantics, this vulnerability class will recur at other call sites.

Reviewed through automated stages and approved by a human before publication.