Cloudanix VulnDB

CVE-2026-80914

High · 8.8

CVSS

8.8

EPSS

0.2%

Published

Sep 9, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how Linux handles certain Bluetooth connections can let nearby attackers crash the system or potentially run their own code.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in iso_conn_ready when a BIS listener socket is closed concurrently after iso_get_sock takes a reference but before the state is re-validated under lock_sock, allowing iso_chan_del and bt_accept_unlink to dereference a dangling parent pointer into already-freed socket structures.

Why it matters to the business

Remote attackers within Bluetooth range can trigger kernel memory corruption on affected Linux systems, potentially causing crashes, denial of service, or arbitrary code execution that disrupts device operation and exposes sensitive data.

How an attack unfolds

An attacker establishes or manipulates ISO/BIS Bluetooth connections to a vulnerable Linux host while simultaneously closing the listener socket; the race between iso_get_sock and the close path leaves a child socket linked to freed memory that is later dereferenced on disconnect.

How to fix it

Apply the upstream fix that re-validates the parent socket state after acquiring the lock (equivalent to commit 0d255e63fcf3); upgrade to a kernel containing the resolution for CVE-2026-80914 as soon as it is available in your distribution.

How to confirm the fix worked

Confirm the presence of the state re-check after lock_sock in iso_conn_ready; verify that kernel builds or packages include the referenced commit; test by exercising concurrent socket close and ISO connection paths under load.

Typical attack path

  1. Position within Bluetooth adjacency to the target device
  2. Trigger creation of an ISO listener socket on the target
  3. Force concurrent close of the listener while iso_conn_ready executes
  4. Cause child socket disconnect to invoke iso_chan_del on the dangling parent pointer
  5. Achieve kernel memory corruption or controlled dereference

How to detect it

Inspect kernel logs for Bluetooth ISO related use-after-free warnings, oops, or panics mentioning iso_conn_ready, iso_chan_del, or bt_accept_unlink; correlate with Bluetooth connection establishment and socket close events around the same timestamp.

What your security team should do

  • Prioritize kernel updates for all Linux systems exposing Bluetooth ISO functionality
  • Disable Bluetooth ISO/BIS support via kernel config or runtime parameters if the feature is unused
  • Monitor for upstream stable and distribution backports within the next patch cycle

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready iso_conn_ready() looks up the BIS listener socket with iso_get_sock(), which takes a reference, and then, without re-checking its state, creates a child socket from it: parent = iso_get_sock(hdev, ...); if (!parent) return; lock_sock(parent); sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...); ... iso_chan_add(conn, sk, parent); ... release_sock(parent); sock_put(parent); If the listener socket is closed concurrently, between iso_get_sock() and lock_sock(), the reference taken by iso_get_sock() may be the last one: the close path drops the link-list reference, and once iso_conn_ready() drops its own reference at the end of the function the socket is freed. The child socket, however, is already linked to the freed parent, and a later disconnect of the child runs iso_chan_del() -> bt_accept_unlink(), which dereferences the dangling parent pointer into the freed accept queue (a use-after-free). The same dangling pointer is also dereferenced through parent->***() in iso_chan_del(). Fix it the same way the connected (non-BIS) path was fixed in commit 0d255e63fcf3 ("Bluetooth: ISO: hold sk properly in iso_conn_ready"): after taking the socket lock, re-check that the parent is still a listening, alive socket, and bail out otherwise.

Affected packages

Ecosystem Package Introduced Fixed