CVE-2026-80721 - Vulnerability Details

- Bluetooth: ISO: ensure no dangling hcon references in iso_conn

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: ensure no dangling hcon references in iso_conn

After iso_conn_del(), ISO sockets should not dereference the hcon any
more. Currently, clearing iso_conn::hcon relies on iso_conn_del()
releasing the last reference to the iso_conn.

Simplify this by explicitly clearing conn->hcon in iso_conn_del(), to
avoid more complex reasoning on races about who holds the last
reference.

Published: 2026-08-28

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel Bluetooth ISO subsystem contains a flaw in iso_conn_del() where the hcon pointer is not cleared, leaving a dangling reference that can be dereferenced after the connection is deleted, resulting in a use‑after‑free error. This flaw was identified as CWE‑911, indicating a use‑after‑free scenario, and may allow an attacker to trigger a crash or denial of service by manipulating ISO Bluetooth traffic, though it requires control over Bluetooth sessions.

Affected Systems

All Linux kernel implementations that contain the legacy Bluetooth ISO subsystem before the commit aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb are affected; this includes any distribution kernel version prior to the patch.

Risk and Exploitability

The CVSS base score of 8.8 signifies high severity, while the EPSS score of less than 1% indicates low exploitation probability; not listed in CISA KEV, and no public exploits are known; an attacker would need to create or manipulate a Bluetooth ISO session from a nearby device to invoke iso_conn_del() and trigger the dangling reference, a scenario that is technically possible but non‑trivial due to the requirement for Bluetooth traffic control.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`dc26097bdb864a0d5955b9a25e43376ffc1af99b`	affected	< e941799c31f68e67ce0976efb38a79101f921b64
`dc26097bdb864a0d5955b9a25e43376ffc1af99b`	affected	< cdce8af9291d8a1f8916c271de029bf558d9e8ec
`dc26097bdb864a0d5955b9a25e43376ffc1af99b`	affected	< aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb
`f53e7489273dc2bb307bf50f319b3762d45534f0`	affected	—
`a58d0f5dac322e16cc75334d000666512341bde5`	affected	—
`6.11.11`	affected	< 6.12
`6.12.2`	affected	< 6.13

Linux

affected

Version	Status	Constraints
`6.13`	affected	—
`0`	unaffected	< 6.13
`6.18.44`	unaffected	≤ 6.18.*
`7.1.8`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e941799c31f68e67ce0976efb38a79101f921b64)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cdce8af9291d8a1f8916c271de029bf558d9e8ec)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb)`	affected	code_commit	—
`[0,6.18.44)`	affected	semver	—
`[0,7.1.8)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.18.44,6.18.*]`	unaffected	generic	—
`[7.1.8,7.1.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that incorporates the commit which clears conn->hcon in iso_conn_del()
If the ISO Bluetooth functionality is not required, disable the ISO subsystem via kernel configuration or runtime settings before installing the update
Monitor system logs for Bluetooth or kernel panic entries that could indicate a use‑after‑free or crash

Generated by OpenCVE AI on September 2, 2026 at 07:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00225.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb
https://git.kernel.org/stable/c/cdce8af9291d8a1f8916c271de029bf558d9e8ec
https://git.kernel.org/stable/c/e941799c31f68e67ce0976efb38a79101f921b64
https://lore.kernel.org/linux-cve-announce/2026082811-CVE-2026-80721-72a6@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-80721
https://www.cve.org/CVERecord?id=CVE-2026-80721

History

Wed, 02 Sep 2026 06:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Wed, 02 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026082811-CVE-2026-80721-72a6@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-80721 https://www.cve.org/CVERecord?id=CVE-2026-80721
Metrics	threat_severity `None`	threat_severity `Moderate`

Sat, 29 Aug 2026 08:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 29 Aug 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Fri, 28 Aug 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in iso_conn After iso_conn_del(), ISO sockets should not dereference the hcon any more. Currently, clearing iso_conn::hcon relies on iso_conn_del() releasing the last reference to the iso_conn. Simplify this by explicitly clearing conn->hcon in iso_conn_del(), to avoid more complex reasoning on races about who holds the last reference.
Title		Bluetooth: ISO: ensure no dangling hcon references in iso_conn
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb https://git.kernel.org/stable/c/cdce8af9291d8a1f8916c271de029bf558d9e8ec https://git.kernel.org/stable/c/e941799c31f68e67ce0976efb38a79101f921b64

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-28T06:53:17.278Z

Updated: 2026-08-30T07:08:36.447Z

Reserved: 2026-08-26T14:34:25.788Z

Link: CVE-2026-80721

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-28T08:16:57.903

Modified: 2026-08-30T07:17:21.673

Link: CVE-2026-80721

Redhat

Severity : Moderate

Publid Date: 2026-08-28T00:00:00Z

Links: CVE-2026-80721 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-02T08:00:14Z

Weaknesses

CWE-911
Improper Update of Reference Count

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object