CVE-2026-74537

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: hold sk properly in iso_conn_ready

sk deref in iso_conn_ready must be done either under conn->lock, or

holding a refcount, to avoid concurrent close. conn->sk is currently

accessed without either:

[Task 1] [Task 2]

iso_sock_release

iso_conn_ready

sk = conn->sk

lock_sock(sk)

conn->sk = NULL

lock_sock(sk)

release_sock(sk)

iso_sock_kill(sk)

UAF on sk deref

Fix possible UAF by holding sk refcount in iso_conn_ready(). Also

recheck after lock_sock that the socket is still valid. Adjust locking

so conn->sk is cleared only under lock_sock.