CVE-2026-80914: Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
Bluetooth: ISO: fix use-after-free of listener socket in isoconnready
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In iso_conn_ready(), after acquiring the parent socket lock, re-check that the parent is still a listening, alive socket; if not, bail out before creating or linking the child socket.
Event History
Frequently Asked Questions
Which deployments are most likely to be exposed?
The affected path involves Bluetooth ISO BIS listener sockets. Systems that do not use this listener path are not described as reaching the vulnerable child-socket linkage.
What timing is required to trigger the dangling parent reference?
The BIS listener socket must be closed concurrently after iso_conn_ready() obtains a reference to it but before it locks the socket. A child socket is then linked to the listener, and a later child disconnect can dereference the freed parent.
Are fixes available for review or backporting?
The supplied references identify stable-tree fixes at commits 2387cd06a2c0b416f05028b02bba1089f54c28d9f54c28d9, 49fd7116f76b860b230843700fb7423ab5331e1f, and 03288b7447c9e572f8ab82fc29cfb4ca719ab210. The provided data does not specify the kernel versions containing those fixes.