CVE-2026-74533

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero

hci_conn::iso_data is accessed and modified without lock or RCU.

This leads to a race

[Task hdev->workqueue] [Task 2]

iso_recv iso_conn_put(conn)

conn = LOAD hcon->iso_data iso_conn_free(conn)

iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL

kfree(conn)

kref_get_unless_zero(&conn->ref) /* UAF */

and also to races in iso_conn_add() vs. iso_conn_free().

Fix by adding spinlock hci_conn::proto_lock and using it to guard

hci_conn::iso_data.