Improper resource shutdown or release in Linux kernel - CVE-2026-74536
Published: August 16, 2026
Vulnerability identifier: #VU143253
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-74536
CWE-ID: CWE-404
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in iso_sock_kill() and ISO socket handling in net/bluetooth/iso.c when releasing and deleting Bluetooth ISO sockets concurrently. A local user can trigger concurrent socket release and connection deletion to cause a denial of service.
The issue results in a leaked socket reference because cleanup may be skipped and the socket destructor may never be called.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-74536
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.105-1
linux (Debian package) - update to 6.12.105-1