CVE-2026-80914 is a vulnerability in Linux Kernel
Published on September 9, 2026
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
iso_conn_ready() looks up the BIS listener socket with iso_get_sock(),
which takes a reference, and then, without re-checking its state,
creates a child socket from it:
parent = iso_get_sock(hdev, ...);
if (!parent)
return;
lock_sock(parent);
sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...);
...
iso_chan_add(conn, sk, parent);
...
release_sock(parent);
sock_put(parent);
If the listener socket is closed concurrently, between iso_get_sock()
and lock_sock(), the reference taken by iso_get_sock() may be the last
one: the close path drops the link-list reference, and once
iso_conn_ready() drops its own reference at the end of the function the
socket is freed. The child socket, however, is already linked to the
freed parent, and a later disconnect of the child runs iso_chan_del()
-> bt_accept_unlink(), which dereferences the dangling parent pointer
into the freed accept queue (a use-after-free). The same dangling
pointer is also dereferenced through parent->***() in
iso_chan_del().
Fix it the same way the connected (non-BIS) path was fixed in commit
0d255e63fcf3 ("Bluetooth: ISO: hold sk properly in iso_conn_ready"):
after taking the socket lock, re-check that the parent is still a
listening, alive socket, and bail out otherwise.
Products Associated with CVE-2026-80914
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version ccf74f2390d60a2f9a75ef496d2564abb478f46a and below 2387cd06a2c0b416f05028b02bba1089f54c28d9 is affected.
- Version ccf74f2390d60a2f9a75ef496d2564abb478f46a and below 49fd7116f76b860b230843700fb7423ab5331e1f is affected.
- Version ccf74f2390d60a2f9a75ef496d2564abb478f46a and below 03288b7447c9e572f8ab82fc29cfb4ca719ab210 is affected.
- Version ccf74f2390d60a2f9a75ef496d2564abb478f46a and below 560bef609fa5992745929e8d7d458b9d88dd2830 is affected.
- Version 6.0 is affected.
- Before 6.0 is unaffected.
- Version 6.12.109, <= 6.12.* is unaffected.
- Version 6.18.50, <= 6.18.* is unaffected.
- Version 7.2.4, <= 7.2.* is unaffected.
- Version 7.3-rc1, <= * is unaffected.