In the Linux kernel Bluetooth ISO stack, the race condition arises when iso_sock_listen() releases the socket lock before calling iso_listen_bis(), enabling two concurrent listen() calls on the same broadcast socket to bypass lock ordering. The second attachment can overwrite the socket connection reference, leaking the first connection and leaving the first socket’s sk field intact. When that socket is torn down, subsequent events on the stale connection trigger a use‑after‑free that results in a kernel crash, leading to a denial of service.

All Linux kernel releases that include the unpatched Bluetooth ISO implementation are affected. The vulnerability exists in kernels that lack the patch incorporated in commits with hashes 555ff78fa719f50ff4cdbdb40aa1acc6e8e327d3, 559e4d2b6f83aaa96061659cc7104b7a0293f9ef, 79993e9919a87068183ba3622c383f05c049c4bc, or 90b744066ca520d1a6a505a11ade9c9a5f48accf; all distributions shipping such kernels are impacted.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to initiate two concurrent ISO listener setups, implying local or privileged access to the target’s Bluetooth stack. If the race is triggered, the kernel crash will cause a system restart or lockup, denying service.