Homepage

Use After Free The advisory has been revoked - it doesn't affect any version of package kernel-modules-internal  (opens in a new tab)

Threat Intelligence

EPSS
0.26% (18th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS10-KERNELMODULESINTERNAL-21730642
  • published27 Oct 2026
  • disclosed15 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 15 Aug 2026

CVE-2026-74537  (opens in a new tab)
CWE-416  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-modules-internal package and not the kernel-modules-internal package as distributed by Centos.

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: hold sk properly in iso_conn_ready

sk deref in iso_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either:

[Task 1]            [Task 2]
                    iso_sock_release
iso_conn_ready
  sk = conn->sk
                      lock_sock(sk)
                        conn->sk = NULL
  lock_sock(sk)
                      release_sock(sk)
                      iso_sock_kill(sk)
   UAF on sk deref

Fix possible UAF by holding sk refcount in iso_conn_ready(). Also recheck after lock_sock that the socket is still valid. Adjust locking so conn->sk is cleared only under lock_sock.