CVE-2026-80721: Bluetooth: ISO: ensure no dangling hcon references in iso_conn
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: ensure no dangling hcon references in isoconn
After isoconndel(), ISO sockets should not dereference the hcon any more. Currently, clearing isoconn::hcon relies on isoconndel() releasing the last reference to the isoconn.
Simplify this by explicitly clearing conn->hcon in isoconndel(), to avoid more complex reasoning on races about who holds the last reference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the kernel Bluetooth ISO code so that iso_conn_del() explicitly clears conn->hcon (so ISO sockets should not dereference a dangling hcon reference after iso_conn_del()).
Linux kernel Bluetooth ISO (iso_conn_del / iso_conn::hcon) iso_conn_del() clears conn->hcon = explicitly clear conn->hcon
Event History
Frequently Asked Questions
What systems are exposed to this issue?
The issue affects Linux kernel systems using Bluetooth ISO connections and ISO sockets. The vulnerability is relevant when an ISO connection has been deleted while a socket could still access its associated connection state.
What condition leads to the unsafe access?
After iso_conn_del() runs, ISO sockets should no longer dereference the hcon pointer. The vulnerable behavior occurs because clearing iso_conn::hcon depended on iso_conn_del() releasing the final iso_conn reference, creating race-related dangling-reference risk.
How is the issue resolved?
The fix explicitly clears conn->hcon in iso_conn_del(). This prevents ISO sockets from retaining a dangling hcon reference after the ISO connection is deleted.