Cloudanix VulnDB

CVE-2026-80721

High · 8.8

CVSS

8.8

EPSS

0.4%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux Bluetooth software could let a nearby attacker take control of or crash the computer.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in Linux kernel Bluetooth ISO socket code where iso_conn_del() fails to immediately clear the hcon pointer, allowing subsequent dereferences of a freed reference due to reference-counting races.

Why it matters to the business

Nearby attackers could gain remote code execution or crash Linux systems using Bluetooth, resulting in data breaches, service disruption, or full host compromise on affected devices.

How an attack unfolds

An attacker within Bluetooth range sends crafted ISO packets to trigger iso_conn_del() while other code paths still hold references; after the connection object is freed the dangling hcon pointer is dereferenced, leading to arbitrary memory access.

How to fix it

Update the Linux kernel to a version containing the explicit conn->hcon = NULL assignment inside iso_conn_del(); rebuild and reboot with the patched kernel.

How to confirm the fix worked

Inspect the iso_conn_del() function in the kernel source for the added hcon-clearing statement; confirm the running kernel version includes the upstream commit that resolved the dangling reference.

Typical attack path

  1. Position within adjacent Bluetooth range
  2. Initiate ISO connection setup
  3. Trigger connection teardown via crafted packets or timing
  4. Exploit the window before hcon is cleared to perform UAF read/write

How to detect it

Review kernel logs and crash dumps for Bluetooth ISO related use-after-free warnings or oops messages referencing iso_conn or hcon; correlate with unexpected Bluetooth connection events.

What your security team should do

  • Apply the upstream kernel fix for Bluetooth ISO immediately
  • Disable Bluetooth ISO support via kernel configuration if the feature is unused
  • Monitor kernel update channels for backported patches to distribution kernels

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in iso_conn After iso_conn_del(), ISO sockets should not dereference the hcon any more. Currently, clearing iso_conn::hcon relies on iso_conn_del() releasing the last reference to the iso_conn. Simplify this by explicitly clearing conn->hcon in iso_conn_del(), to avoid more complex reasoning on races about who holds the last reference.

Affected packages

Ecosystem Package Introduced Fixed