CVE-2026-80721: Bluetooth: ISO: ensure no dangling hcon references in iso_conn
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: ensure no dangling hcon references in isoconn
After isoconndel(), ISO sockets should not dereference the hcon any more. Currently, clearing isoconn::hcon relies on isoconndel() releasing the last reference to the isoconn.
Simplify this by explicitly clearing conn->hcon in isoconndel(), to avoid more complex reasoning on races about who holds the last reference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What systems are exposed to this issue?
The issue affects Linux kernel systems using Bluetooth ISO connections and ISO sockets. The vulnerability is relevant when an ISO connection has been deleted while a socket could still access its associated connection state.
What condition leads to the unsafe access?
After iso_conn_del() runs, ISO sockets should no longer dereference the hcon pointer. The vulnerable behavior occurs because clearing iso_conn::hcon depended on iso_conn_del() releasing the final iso_conn reference, creating race-related dangling-reference risk.
How is the issue resolved?
The fix explicitly clears conn->hcon in iso_conn_del(). This prevents ISO sockets from retaining a dangling hcon reference after the ISO connection is deleted.