Answer in brief
CVE-2026-74538 records a Unknown severity vulnerability in Bluetooth: ISO: lock sk in iso_connect_ind. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=168d9bf9c7f01df71e6404cfff66d9c2a8e968fb <e8e9cff6d80eeec28dec4cf7cc18662986945391 || >=168d9bf9c7f01df71e6404cfff66d9c2a8e968fb <9bee7e476534f27e830658dad962d85da9edf6bf || >=168d9bf9c7f01df71e6404cfff66d9c2a8e968fb <4311fd6f429065a8ba208660360a895627a00cf3 || 489efc9ae36f164423f5fa7ace772a7ab8131cd8 || >=6.8.9 <6.9 | e8e9cff6d80eeec28dec4cf7cc18662986945391, 9bee7e476534f27e830658dad962d85da9edf6bf, 4311fd6f429065a8ba208660360a895627a00cf3, 6.9 |
| Linux/Linuxgeneric | 6.9 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_connect_ind Accessing iso_pi(sk)->conn requires lock_sock, which is not taken in the "ev3" part of iso_connect_ind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before locking. Fix by adding lock/release. Recheck hcon is valid after lock acquire where needed.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-74538 records a Unknown severity vulnerability in Bluetooth: ISO: lock sk in iso_connect_ind. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=168d9bf9c7f01df71e6404cfff66d9c2a8e968fb <e8e9cff6d80eeec28dec4cf7cc18662986945391 || >=168d9bf9c7f01df71e6404cfff66d9c2a8e968fb <9bee7e476534f27e830658dad962d85da9edf6bf || >=168d9bf9c7f01df71e6404cfff66d9c2a8e968fb <4311fd6f429065a8ba208660360a895627a00cf3 || 489efc9ae36f164423f5fa7ace772a7ab8131cd8 || >=6.8.9 <6.9 | e8e9cff6d80eeec28dec4cf7cc18662986945391, 9bee7e476534f27e830658dad962d85da9edf6bf, 4311fd6f429065a8ba208660360a895627a00cf3, 6.9 |
| Linux/Linuxgeneric | 6.9 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_connect_ind Accessing iso_pi(sk)->conn requires lock_sock, which is not taken in the "ev3" part of iso_connect_ind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before locking. Fix by adding lock/release. Recheck hcon is valid after lock acquire where needed.
Quoted source text, attributed separately from HOL analysis.