A use‑after‑free condition was discovered in the Linux kernel Bluetooth ISO subsystem. The bug occurs when a Bluetooth ISO connection is detached; the iso_data pointer remains on the hcon structure, causing iso_conn_free() to dereference freed memory. An attacker could trigger this sequence and corrupt kernel memory, potentially leading to privilege escalation or denial of service.

This issue affects the Linux kernel’s Bluetooth ISO implementation. No specific kernel release numbers are listed in the data, so any kernel build that has not applied the patch will be vulnerable.

The vulnerability is a kernel‑level use‑after‑free, a high‑risk flaw that could allow an attacker with access to the Bluetooth driver to crash the system or execute arbitrary code. The EPSS score is not available, and the issue is not in the KEV catalog, but the absence of a mitigation in widely deployed kernels suggests a realistic exploitation possibility once the driver is exposed. Immediate patching is recommended.