CVE-2026-53276

What it actually does

This is a use-after-free flaw in the Linux kernel Bluetooth ISO socket handling path. In iso_sock_rebind_bc(), the kernel caches a Bluetooth HCI connection pointer, releases the socket lock, and then later dereferences data reachable from that cached pointer. A concurrent close() or connection teardown during the unlocked window can free the underlying hci_conn structure before it is reused, causing the kernel to access freed memory. Depending on kernel configuration, heap layout, and Bluetooth access controls, the most likely outcomes are kernel crash or memory corruption; in higher-risk scenarios, a local attacker with access to Bluetooth socket operations may be able to turn the race into privilege escalation or arbitrary kernel-code execution.

Why it matters to the business

Systems with vulnerable Linux kernels and enabled Bluetooth functionality may be susceptible to local denial of service through kernel crashes, and potentially deeper host compromise if the memory corruption can be reliably weaponized. The operational risk is highest on laptops, workstations, embedded Linux devices, kiosks, IoT/edge systems, and servers where Bluetooth is enabled or exposed to untrusted local users. This issue is not listed in CISA KEV, is not currently associated with ransomware use, and has a low EPSS score, so it should be prioritized as kernel hardening and exposure reduction rather than treated as an active mass-exploitation emergency.

How an attack unfolds

An attacker needs a way to exercise the vulnerable Linux Bluetooth ISO socket code path. They would typically require local code execution or the ability to run a process that can interact with Bluetooth sockets. The attacker opens or manipulates an ISO Bluetooth socket, triggers a rebind operation that enters iso_sock_rebind_bc(), and then races a concurrent close or teardown so that the connection object is freed while the function still holds a stale cached pointer. When the kernel later attempts to lock or dereference data through that freed pointer, it may crash or corrupt kernel memory. Successful exploitation depends on precise race timing, heap shaping, kernel mitigations, Bluetooth availability, and whether the attacker can access the relevant socket families and capabilities.

How to fix it

Upgrade to a Linux kernel version that includes the upstream fix for the Bluetooth ISO use-after-free in iso_sock_rebind_bc(). If vendor fixed versions are not yet available, track the relevant distribution kernel advisory and apply the first patched kernel package released by the operating system vendor. Where immediate patching is not possible, reduce exposure by disabling Bluetooth on systems that do not require it, blocking untrusted local users from accessing Bluetooth functionality, removing or blacklisting Bluetooth kernel modules where operationally safe, and applying standard kernel hardening controls such as lockdown mode, module signing, unprivileged user namespace restrictions, and rapid reboot procedures for kernel crash recovery.

How to confirm the fix worked

Confirm remediation by verifying the running kernel version and package build against the vendor advisory that contains the fix. On source-based or custom kernels, confirm the Bluetooth ISO patch is present and that iso_sock_rebind_bc() uses a safely referenced hdev rather than dereferencing the potentially freed hci_conn pointer after releasing the socket lock. Validate that Bluetooth is disabled or unavailable on systems where it is not needed. For exposure assessment, inventory Linux systems with Bluetooth hardware, loaded Bluetooth modules, or active Bluetooth services, and prioritize those with multi-user access or untrusted local code execution risk.

Typical attack path

1. Gain local code execution on a Linux host or device where Bluetooth support is enabled and the vulnerable kernel is present.
2. Open or interact with Bluetooth ISO sockets to reach the affected iso_sock_rebind_bc() code path.
3. Trigger a rebind operation while concurrently closing or tearing down the associated Bluetooth connection.
4. Win the race so the hci_conn object is freed after its pointer is cached but before the kernel dereferences it again.
5. Cause a kernel use-after-free condition, resulting in a crash, memory corruption, or potentially privilege escalation if the heap state is controlled well enough.

How to detect it

Look for evidence of attempted or successful exploitation in kernel logs, crash dumps, endpoint telemetry, and system journals. Relevant sources include dmesg, journald, /var/log/kern.log, /var/log/messages, crash dump facilities such as kdump/vmcore, KASAN/KFENCE reports, audit logs for suspicious local processes interacting with Bluetooth sockets, and EDR telemetry showing unusual Bluetooth-related socket activity followed by a kernel oops or reboot. Focus on crashes or warnings referencing iso_sock_rebind_bc(), Bluetooth ISO, hci_conn, hci_dev_lock(), use-after-free, slab corruption, or general protection faults in Bluetooth kernel code. Because exploitation is race-condition based and may leave no durable artifact beyond a kernel fault or reboot, absence of these logs does not prove non-exploitation. There are no public threat actors or campaigns currently associated with this issue based on the supplied data.

• iso_sock_rebind_bc
• hci_dev_lock
• hci_conn
• Bluetooth: ISO
• BUG: KASAN: use-after-free
• KASAN: use-after-free
• KFENCE: use-after-free
• general protection fault
• kernel BUG at net/bluetooth/iso.c
• Oops:
• Call Trace:
• net/bluetooth/iso.c
• bluetooth
• bt_iso
• AF_BLUETOOTH
• BTPROTO_ISO

What your security team should do

• Inventory Linux endpoints, embedded systems, and appliances with Bluetooth enabled or Bluetooth kernel modules loaded.
• Prioritize patching systems where untrusted users can run local code, including shared workstations, developer machines, kiosks, and edge devices.
• Apply vendor kernel updates as soon as available; reboot systems to ensure the patched kernel is running.
• Disable Bluetooth in BIOS/UEFI, system configuration, or kernel module policy where it is not operationally required.
• Monitor for kernel crashes, KASAN reports, oops traces, or repeated Bluetooth socket errors involving iso_sock_rebind_bc, hci_conn, hci_dev_lock, or ISO Bluetooth paths.
• Because there is no KEV listing, no ransomware association, no known mature exploit, and low EPSS, handle as a defense-in-depth kernel patching priority unless local attack surface is high.