CVE-2026-74533

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero<br /> <br /> hci_conn::iso_data is accessed and modified without lock or RCU.<br /> This leads to a race<br /> <br /> [Task hdev-&gt;workqueue] [Task 2]<br /> iso_recv iso_conn_put(conn)<br /> conn = LOAD hcon-&gt;iso_data iso_conn_free(conn)<br /> iso_conn_hold_unless_zero(conn) hcon-&gt;iso_data = NULL<br /> kfree(conn)<br /> kref_get_unless_zero(&amp;conn-&gt;ref) /* UAF */<br /> <br /> and also to races in iso_conn_add() vs. iso_conn_free().<br /> <br /> Fix by adding spinlock hci_conn::proto_lock and using it to guard<br /> hci_conn::iso_data.