Executive brief
The Linux kernel's Bluetooth ISO (Isochronous) connection handler contains a use-after-free vulnerability in the iso_conn management code. An attacker with local access could exploit dangling references to trigger a kernel crash or potentially execute arbitrary code, affecting system stability and potentially compromising the entire system.
Technical details
The vulnerability exists in the Bluetooth ISO socket implementation (net/bluetooth/iso.c), where the iso_conn_del() function failed to explicitly clear the hcon (HCI connection) pointer before ISO sockets could still reference it. This created a race condition where dangling hcon references could lead to use-after-free access. The fix explicitly clears conn->hcon in iso_conn_del() while holding the appropriate locks, and adds validation in __iso_chan_add() to detect missing hcon pointers. The vulnerability affects local privilege escalation through malformed or racing Bluetooth ISO socket operations.
Affected products
- Linux Linux kernel Multiple versions prior to the fix (commit aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb and backports)
Timeline
- 2026-08-28: disclosed: CVE-2026-80721 published
- 2026-07-24: patched: Upstream commit aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb
- 2026-08-09: patched: Backport to stable kernels (commit cdce8af9291d8a1f8916c271de029bf558d9e8ec)