CVE-2026-74534: Bluetooth: ISO: fix refcounting of iso_conn

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: fix refcounting of iso_conn

iso_conn_del() and iso_chan_del() have a race that results to double-put
of iso_conn:

    [Task hdev->workqueue]         [Task 2]
    iso_conn_del                   iso_chan_del
      iso_conn_hold_unless_zero      iso_conn_lock
      iso_conn_lock                  conn->sk = NULL
                                     iso_conn_unlock
      sk = iso_sock_hold(conn)  <---------´
      if (!sk) iso_conn_put          iso_conn_put
      iso_conn_put /* UAF */

The extra put for !sk in iso_conn_del() is currently required since
failing iso_chan_add() may leave iso_conn not associated with any sk.

Fix by having iso_pi(sk)->conn own refcount when non-NULL, so
iso_conn_del does not need to put it.  Adjust the iso_conn_add()
refcounting so that conn is put if it does not get associated with an
sk.

The Linux kernel CVE team has assigned CVE-2026-74534 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.13 with commit dc26097bdb864a0d5955b9a25e43376ffc1af99b and fixed in 6.18.44 with commit 3b921533e8aa95b77aadcf31737595578e735f3c
	Issue introduced in 6.13 with commit dc26097bdb864a0d5955b9a25e43376ffc1af99b and fixed in 7.1.8 with commit 8208b4939afb0a1977fffe902c3ca42fe0f3baaa
	Issue introduced in 6.13 with commit dc26097bdb864a0d5955b9a25e43376ffc1af99b and fixed in 7.2-rc6 with commit fdfde532ab1caa165fcd8985001157ac8b4db365
	Issue introduced in 6.11.11 with commit f53e7489273dc2bb307bf50f319b3762d45534f0
	Issue introduced in 6.12.2 with commit a58d0f5dac322e16cc75334d000666512341bde5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74534
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bluetooth/iso.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3b921533e8aa95b77aadcf31737595578e735f3c
	https://git.kernel.org/stable/c/8208b4939afb0a1977fffe902c3ca42fe0f3baaa
	https://git.kernel.org/stable/c/fdfde532ab1caa165fcd8985001157ac8b4db365