CVE-2026-80914: Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: fix use-after-free of listener socket in isoconnready

isoconnready() looks up the BIS listener socket with isogetsock(), which takes a reference, and then, without re-checking its state, creates a child socket from it:

parent = isogetsock(hdev, ...); if (!parent) return;

locksock(parent); sk = isosockalloc(socknet(parent), NULL, BTPROTOISO, ...); ... isochanadd(conn, sk, parent); ... releasesock(parent); sockput(parent);

If the listener socket is closed concurrently, between isogetsock() and locksock(), the reference taken by isogetsock() may be the last one: the close path drops the link-list reference, and once isoconnready() drops its own reference at the end of the function the socket is freed. The child socket, however, is already linked to the freed parent, and a later disconnect of the child runs isochandel() -> btacceptunlink(), which dereferences the dangling parent pointer into the freed accept queue (a use-after-free). The same dangling pointer is also dereferenced through parent->() in isochandel().

Fix it the same way the connected (non-BIS) path was fixed in commit 0d255e63fcf3 ("Bluetooth: ISO: hold sk properly in isoconnready"): after taking the socket lock, re-check that the parent is still a listening, alive socket, and bail out otherwise.