{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80914", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.801Z", "datePublished": "2026-09-09T16:10:58.675Z", "dateUpdated": "2026-09-10T05:50:21.452Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-10T05:50:21.452Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready\n\niso_conn_ready() looks up the BIS listener socket with iso_get_sock(),\nwhich takes a reference, and then, without re-checking its state,\ncreates a child socket from it:\n\n parent = iso_get_sock(hdev, ...);\n if (!parent)\n return;\n\n lock_sock(parent);\n sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...);\n ...\n iso_chan_add(conn, sk, parent);\n ...\n release_sock(parent);\n sock_put(parent);\n\nIf the listener socket is closed concurrently, between iso_get_sock()\nand lock_sock(), the reference taken by iso_get_sock() may be the last\none: the close path drops the link-list reference, and once\niso_conn_ready() drops its own reference at the end of the function the\nsocket is freed. The child socket, however, is already linked to the\nfreed parent, and a later disconnect of the child runs iso_chan_del()\n-> bt_accept_unlink(), which dereferences the dangling parent pointer\ninto the freed accept queue (a use-after-free). The same dangling\npointer is also dereferenced through parent->***() in\niso_chan_del().\n\nFix it the same way the connected (non-BIS) path was fixed in commit\n0d255e63fcf3 (\"Bluetooth: ISO: hold sk properly in iso_conn_ready\"):\nafter taking the socket lock, re-check that the parent is still a\nlistening, alive socket, and bail out otherwise."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The UAF is in Bluetooth ISO iso_conn_ready() parent-lookup for incoming CIS/BIS/PA; that path runs from HCI connect_cfm events (hci_le_cis_req_evt, BIG/PA sync) driven by LE isochronous traffic from peers in radio range, which is an adjacent attack surface.\nAC:L - This is a use-after-free race between iso_get_sock() and listener close (iso_sock_release/iso_sock_kill) before lock_sock(); an attacker who opens/closes an ISO listen socket while concurrent HCI CIS/BIS/PA completion runs controls both sides and can trigger it without uncontrollable conditions.\nPR:N - iso_sock_create has no capability check, and the vulnerable path is reached from unauthenticated HCI CIS/BIG/PA events processed for any Bluetooth-enabled device in range; listener close can occur from automatic LE Audio/bluetoothd teardown without privileged local credentials.\nUI:N - No victim action is required: iso_connect_ind returns HCI_LM_ACCEPT so incoming CIS/BIS/PA sync is auto-accepted when an ISO listener exists, and OS LE Audio stacks keep such listeners during normal broadcast/unicast operation.\nS:U - The UAF corrupts kernel socket/accept-queue memory and can enable privilege escalation within the host kernel; it does not cross a VM, container, or IOMMU security boundary, so scope remains unchanged.\nC:H - Use-after-free of the listener struct sock (and later bt_accept_unlink of the dangling parent) lets an attacker reuse the freed sock/accept-queue object, enabling arbitrary kernel memory disclosure via heap grooming per UAF guidance.\nI:H - The child is linked to the freed parent via iso_chan_add/bt_accept_enqueue; later iso_chan_del -> bt_accept_unlink writes the freed parent's accept queue (list_del, sk_acceptq_removed), a kernel heap write primitive usable for control-flow hijack.\nA:H - Dereferencing the freed listener in iso_chan_del/bt_accept_unlink (accept_q_lock, list, parent->sk_data_ready) causes kernel oops/panic; UAFs in this ISO path are a high availability impact even before full exploitation."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/iso.c"], "versions": [{"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a", "lessThan": "2387cd06a2c0b416f05028b02bba1089f54c28d9", "status": "affected", "versionType": "git"}, {"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a", "lessThan": "49fd7116f76b860b230843700fb7423ab5331e1f", "status": "affected", "versionType": "git"}, {"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a", "lessThan": "03288b7447c9e572f8ab82fc29cfb4ca719ab210", "status": "affected", "versionType": "git"}, {"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a", "lessThan": "560bef609fa5992745929e8d7d458b9d88dd2830", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/iso.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2387cd06a2c0b416f05028b02bba1089f54c28d9"}, {"url": "https://git.kernel.org/stable/c/49fd7116f76b860b230843700fb7423ab5331e1f"}, {"url": "https://git.kernel.org/stable/c/03288b7447c9e572f8ab82fc29cfb4ca719ab210"}, {"url": "https://git.kernel.org/stable/c/560bef609fa5992745929e8d7d458b9d88dd2830"}], "title": "Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/iso.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2387cd06a2c0b416f05028b02bba1089f54c28d9", "status": "affected", "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a", "versionType": "git"}, {"lessThan": "49fd7116f76b860b230843700fb7423ab5331e1f", "status": "affected", "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a", "versionType": "git"}, {"lessThan": "03288b7447c9e572f8ab82fc29cfb4ca719ab210", "status": "affected", "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a", "versionType": "git"}, {"lessThan": "560bef609fa5992745929e8d7d458b9d88dd2830", "status": "affected", "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/iso.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready\n\niso_conn_ready() looks up the BIS listener socket with iso_get_sock(),\nwhich takes a reference, and then, without re-checking its state,\ncreates a child socket from it:\n\n parent = iso_get_sock(hdev, ...);\n if (!parent)\n return;\n\n lock_sock(parent);\n sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...);\n ...\n iso_chan_add(conn, sk, parent);\n ...\n release_sock(parent);\n sock_put(parent);\n\nIf the listener socket is closed concurrently, between iso_get_sock()\nand lock_sock(), the reference taken by iso_get_sock() may be the last\none: the close path drops the link-list reference, and once\niso_conn_ready() drops its own reference at the end of the function the\nsocket is freed. The child socket, however, is already linked to the\nfreed parent, and a later disconnect of the child runs iso_chan_del()\n-> bt_accept_unlink(), which dereferences the dangling parent pointer\ninto the freed accept queue (a use-after-free). The same dangling\npointer is also dereferenced through parent->***() in\niso_chan_del().\n\nFix it the same way the connected (non-BIS) path was fixed in commit\n0d255e63fcf3 (\"Bluetooth: ISO: hold sk properly in iso_conn_ready\"):\nafter taking the socket lock, re-check that the parent is still a\nlistening, alive socket, and bail out otherwise."}], "id": "CVE-2026-80914", "lastModified": "2026-09-10T06:17:05.900", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-09T17:17:46.263", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/03288b7447c9e572f8ab82fc29cfb4ca719ab210"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2387cd06a2c0b416f05028b02bba1089f54c28d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/49fd7116f76b860b230843700fb7423ab5331e1f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/560bef609fa5992745929e8d7d458b9d88dd2830"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}