CVE-2026-80914

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

iso_conn_ready() looks up the BIS listener socket with iso_get_sock(),

which takes a reference, and then, without re-checking its state,

creates a child socket from it:

parent = iso_get_sock(hdev, ...);

if (!parent)

return;

lock_sock(parent);

sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...);

...

iso_chan_add(conn, sk, parent);

...

release_sock(parent);

sock_put(parent);

If the listener socket is closed concurrently, between iso_get_sock()

and lock_sock(), the reference taken by iso_get_sock() may be the last

one: the close path drops the link-list reference, and once

iso_conn_ready() drops its own reference at the end of the function the

socket is freed. The child socket, however, is already linked to the

freed parent, and a later disconnect of the child runs iso_chan_del()

-> bt_accept

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References