Description
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

iso_conn_ready() looks up the BIS listener socket with iso_get_sock(),
which takes a reference, and then, without re-checking its state,
creates a child socket from it:

parent = iso_get_sock(hdev, ...);
if (!parent)
return;

lock_sock(parent);
sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...);
...
iso_chan_add(conn, sk, parent);
...
release_sock(parent);
sock_put(parent);

If the listener socket is closed concurrently, between iso_get_sock()
and lock_sock(), the reference taken by iso_get_sock() may be the last
one: the close path drops the link-list reference, and once
iso_conn_ready() drops its own reference at the end of the function the
socket is freed. The child socket, however, is already linked to the
freed parent, and a later disconnect of the child runs iso_chan_del()
-> bt_accept_unlink(), which dereferences the dangling parent pointer
into the freed accept queue (a use-after-free). The same dangling
pointer is also dereferenced through parent->***() in
iso_chan_del().

Fix it the same way the connected (non-BIS) path was fixed in commit
0d255e63fcf3 ("Bluetooth: ISO: hold sk properly in iso_conn_ready"):
after taking the socket lock, re-check that the parent is still a
listening, alive socket, and bail out otherwise.
Published: 2026-09-09
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In the Linux kernel, a race condition in the Bluetooth ISO subsystem allows a listener socket to be freed while a child socket is created from it, resulting in a use‑after‑free and kernel crash or denial of service.

Affected Systems

All Linux kernel builds that include Bluetooth ISO support and have not yet incorporated commit 0d255e63fcf3 are potentially impacted; no specific version range is provided, so any kernel containing the vulnerable code path is at risk.

Risk and Exploitability

Based on the description, the flaw may be triggered by an attacker initiating concurrent Bluetooth ISO connections and closing the listener socket during the attempt, leading to a use‑after‑free (CWE‑416). Based on the description, the likely attack vector is remote or local via Bluetooth without additional privileges. The CVSS score is not listed in the provided data, and the EPSS score is unavailable; however, the kernel‑level nature of the flaw conveys a high impact if exploited. The vulnerability is not listed in CISA’s KEV catalog, but the lack of an EPSS score does not diminish the potential for a crafted Bluetooth attack.

Generated by OpenCVE AI on September 9, 2026 at 18:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest kernel update that contains commit 0d255e63fcf3, or apply the patch to your current kernel source and rebuild.
  • Reboot the system so the updated kernel is loaded.
  • If a kernel upgrade cannot be performed immediately, disable Bluetooth ISO functionality or block Bluetooth traffic until the fix is applied.

Generated by OpenCVE AI on September 9, 2026 at 18:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Wed, 09 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready iso_conn_ready() looks up the BIS listener socket with iso_get_sock(), which takes a reference, and then, without re-checking its state, creates a child socket from it: parent = iso_get_sock(hdev, ...); if (!parent) return; lock_sock(parent); sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...); ... iso_chan_add(conn, sk, parent); ... release_sock(parent); sock_put(parent); If the listener socket is closed concurrently, between iso_get_sock() and lock_sock(), the reference taken by iso_get_sock() may be the last one: the close path drops the link-list reference, and once iso_conn_ready() drops its own reference at the end of the function the socket is freed. The child socket, however, is already linked to the freed parent, and a later disconnect of the child runs iso_chan_del() -> bt_accept_unlink(), which dereferences the dangling parent pointer into the freed accept queue (a use-after-free). The same dangling pointer is also dereferenced through parent->***() in iso_chan_del(). Fix it the same way the connected (non-BIS) path was fixed in commit 0d255e63fcf3 ("Bluetooth: ISO: hold sk properly in iso_conn_ready"): after taking the socket lock, re-check that the parent is still a listening, alive socket, and bail out otherwise.
Title Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-09T16:10:58.675Z

Reserved: 2026-08-26T14:34:25.801Z

Link: CVE-2026-80914

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-09T17:17:46.263

Modified: 2026-09-09T17:17:46.263

Link: CVE-2026-80914

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-09T19:00:15Z

Weaknesses