Executive brief
The Linux kernel's Bluetooth ISO (Isochronous) connection handling contains a race condition in socket state management and connection object lifecycle. An attacker with local access could exploit improper locking to cause a kernel NULL pointer dereference, leading to a denial of service or potential code execution through the crashed kernel interface.
Technical details
The vulnerability is a race condition in the Bluetooth ISO socket implementation (net/bluetooth/iso.c) where concurrent access to sk_state and iso_conn pointers occurs without proper locking. The root cause is that iso_conn_del can be invoked while iso_connect_cis/iso_connect_bis are still executing, causing use-after-free and NULL pointer dereference. The lock ordering (hci_dev_lock > lock_sock > iso_conn_lock) is not consistently enforced across all code paths, particularly in connect/disconnect operations and send/receive message handling. An attacker with local access can trigger the race by opening Bluetooth ISO sockets and concurrently issuing connect and disconnect operations, leading to a kernel crash via NULL dereference at iso_sock_close. The fix involves proper lock acquisition around state transitions and extending hdev->lock scope to prevent iso_conn_del during connection setup.
Affected products
- Linux Linux kernel Linux kernel versions prior to patch (CVE-2023-54164)
Timeline
- 2025-12-30: disclosed
- 2025-12-30: advisory: CVE-2023-54164 published