CVE-2026-53276: Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: Fix a use-after-free of the hciconn pointer
In isosockrebindbc(), the bis pointer is cached, then the socket lock is dropped: bis = isopi(sk)->conn->hcon; / Release the socket before lookups since that requires hcidevlock which shall not be acquired while holding socklock for proper ordering. / releasesock(sk); hcidevlock(bis->hdev);
During the unlocked window, could a concurrent close() destroy the connection and free the bis structure, causing hcidevlock(bis->hdev) to access memory after it is freed, fix this by using the hdev reference which was safely acquired via isoconngethdev().
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53276?
CVE-2026-53276 has a risk score of 37, indicating a significant potential impact.
How do I fix CVE-2026-53276?
To fix CVE-2026-53276, ensure that you update your Linux kernel to the latest version that resolves this vulnerability.
What is the impact of CVE-2026-53276?
The impact of CVE-2026-53276 is a potential use-after-free condition that can lead to stability issues or unexpected behavior in Bluetooth functionalities.
Which software is affected by CVE-2026-53276?
CVE-2026-53276 affects the Linux kernel, particularly in its Bluetooth stack implementation.
What is the nature of the vulnerability identified in CVE-2026-53276?
CVE-2026-53276 is categorized as a use-after-free vulnerability which allows access to freed memory, potentially leading to security risks.