Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth subsystem that could lead to a system crash. The issue occurs when the system attempts to close a specific type of Bluetooth connection (ISO) while another process is simultaneously deleting it. This race condition can cause the operating system to stop responding or restart, potentially impacting system availability.
Technical details
A race condition exists in net/bluetooth/iso.c due to improper locking in iso_sock_close(). The function iso_sock_clear_timer() is called before acquiring the socket lock (lock_sock(sk)), allowing it to read iso_pi(sk)->conn without synchronization. If iso_conn_del() runs concurrently on another CPU, it can set the connection pointer to NULL or drop the final reference after iso_sock_clear_timer() has already performed its initial NULL check. This results in either a NULL pointer dereference or a use-after-free (UAF) when cancel_delayed_work() is subsequently called. The fix involves moving the iso_sock_clear_timer() call inside the locked section of iso_sock_close().
Affected products
- Linux Linux Kernel 6.0 to 6.1.176, 6.6.143, 6.12.y, 6.13.y, 6.14.y, 6.15.y
Timeline
- 2026-05-27: other: Vulnerability fixed in upstream commits
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/35f68f36d9883d56dec21cf85f7556d4657fc393
- https://git.kernel.org/stable/c/4b5f8e608749b7e8fa386c6e4301cf9272595859
- https://git.kernel.org/stable/c/51cb9dcfdf9a1bccf312ab2ae4b62db629f7dcd5
- https://git.kernel.org/stable/c/996c2104d0726a8fe584f85b3d6327197374a348
- https://git.kernel.org/stable/c/bc08c15746f25f41dd0508b25780d1e84acbb2ef
- https://git.kernel.org/stable/c/d9cbf7144ec589a3f0cc91f74a1a1af2d2b14afa