Linux kernel Bluetooth ISO: Race condition in concurrent BIS listener setup
Summary
A race condition in the Linux kernel's Bluetooth ISO socket code lets two concurrent listen() calls on the same broadcast socket both pass the bound-state check. The second connection attachment overwrites a pointer and leaks a reference, which can later lead to a use-after-free. The attacker needs a local account; the CVSS base score is 7.8 (High) with high impact on confidentiality, integrity and availability.
Affected
- Linux kernel: affected from 6.13 (OSV); CNA record also lists 6.12.6 to before 6.12.113
- Commit-based ranges in the CNA record; upstream release mapping to be verified
Fixed in
- 6.12.113 (per CNA record and OSV)
- 6.18.57 (per CNA record and OSV)
- 7.2.11 (per CNA record and OSV)
- Fix commits: 555ff78fa719, 559e4d2b6f83, 79993e9919a8, 90b744066ca5
Workaround
Unknown. No workaround is documented in the sources. On systems that do not need Bluetooth, the Bluetooth stack or modules can be disabled until the kernel is updated.
Exploitation
- Exploited in the wild: no evidence found
- Public proof of concept: none found
- EPSS: 0.00159 (low predicted exploitation probability)
- Not confirmed in CISA KEV (catalog could not be queried directly)
Our recommendation
- Install the distribution kernel update as soon as it is available, prioritising multi-user Linux systems and systems with Bluetooth
- Until patched, disable Bluetooth on hosts that do not need it
- Restrict local user accounts on multi-user systems
- Verify the fixed version against your distribution advisory rather than relying on the NVD score alone
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable commit 555ff78fa719 git.kernel.org
- Linux kernel stable commit 559e4d2b6f83 git.kernel.org
- Linux kernel stable commit 79993e9919a8 git.kernel.org
- Linux kernel stable commit 90b744066ca5 git.kernel.org
- Ubuntu CVE page ubuntu.com
- OSV entry (Vulners) vulners.com
- NVD mirror (Vulners) vulners.com
- Strix CVE aggregation www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:26.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup iso_sock_listen() drops the socket lock before calling iso_listen_bis() to preserve the hdev->lock ordering. Two concurrent listen() calls on the same broadcast socket can therefore both observe BT_BOUND. Caller A can attach connA and release the locks, then caller B can acquire them and attach connB before A publishes BT_LISTEN. __iso_chan_add() checks whether connB already has a socket, but not whether the socket already has a connection. The second attachment overwrites iso_pi(sk)->conn, leaking the connA reference and leaving connA->sk intact. Socket teardown follows connB, so later events on connA can cause a stale socket access. Recheck BT_BOUND and require iso_pi(sk)->conn to be NULL after taking both the HCI device and socket locks in iso_listen_bis(). The connection check also covers the interval between attachment and publication of BT_LISTEN. Reject a competing setup with -EBADFD through the existing unlock path before allocating another connection. A recorded KASAN report from an instrumented kernel shows: BUG: KASAN: slab-use-after-free in iso_sock_hold+0x119/0x1f0 Call Trace: iso_sock_hold+0x119/0x1f0 iso_conn_del+0xe4/0x270 hci_disconn_complete_evt+0x351/0x8c0 hci_event_packet+0x71b/0xb20 hci_rx_work+0x293/0x730 Allocated by task 93: sk_prot_alloc+0x113/0x220 sk_alloc+0x2b/0x6d0 bt_sock_alloc+0x29/0x370 iso_sock_alloc.constprop.0+0x19/0x300 iso_sock_create+0x94/0x100 Freed by task 93: kfree+0x121/0x3c0 __sk_destruct+0x42b/0x540 iso_sock_release+0x29d/0x340 __sock_release+0xa1/0x260 sock_close+0x10/0x20
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.