Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race [Task hdev->workqueue] [Task 2] iso_recv iso_conn_put(conn) conn = LOAD hcon->iso_data iso_conn_free(conn) iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL kfree(conn) kref_get_unless_zero(&conn->ref) /* UAF */ and also to races in iso_conn_add() vs. iso_conn_free(). Fix by adding spinlock hci_conn::proto_lock and using it to guard hci_conn::iso_data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:17:58.603Z",
  "pubdate": "2026-08-15T13:17:58.603Z",
  "executiveSummary": "A race condition vulnerability exists in the Linux kernel Bluetooth subsystem involving the handling of ISO (isochronous) connection structures. The flaw arises due to the concurrent access and modification of the hci_conn::iso_data pointer without proper synchronization mechanisms such as locks or Read-Copy Update (RCU). This lack of concurrency control allows a race condition to manifest between the packet reception path (iso_recv) attempting to acquire a reference to the connection, and the connection teardown path (iso_conn_put and iso_conn_free) releasing and freeing the underlying memory.\nThe primary impact of this vulnerability is a Use-After-Free (UAF) condition, which can potentially lead to kernel memory corruption, system crashes, or arbitrary code execution within the kernel context. The vulnerability affects the Linux kernel Bluetooth subsystem handling of ISO connections. Exploitation of this flaw generally requires local execution capabilities or the ability to trigger specific Bluetooth traffic sequences that induce the race condition between the workqueue task processing incoming data and the connection cleanup routines.",
  "technicalDetails": "The vulnerability resides in the Linux kernel Bluetooth subsystem, specifically within the management of isochronous connections referenced via hci_conn::iso_data. The root cause is the absence of locking or RCU protection during the read, write, and reference-counting operations performed on the connection pointer across asynchronous execution contexts.\nThe attack flow involves a race condition between two primary execution tasks: Task hdev->workqueue executing iso_recv, and Task 2 executing iso_conn_put(conn) followed by iso_conn_free(conn). During data reception, iso_recv loads the connection pointer via conn = LOAD hcon->iso_data and subsequently attempts to increment the reference counter using iso_conn_hold_unless_zero(conn), which invokes kref_get_unless_zero(&conn->ref). Simultaneously, Task 2 may execute iso_conn_free(conn), which sets hcon->iso_data = NULL and immediately frees the underlying memory structure via kfree(conn). If Task 2 completes the memory deallocation before Task 1 executes kref_get_unless_zero(), Task 1 attempts to dereference and modify a reference counter located within freed memory, resulting in a Use-After-Free vulnerability.\nSimilar race conditions also occur between iso_conn_add() and iso_conn_free() during connection lifecycle transitions. Because the pointer manipulation lacks synchronization primitives, an attacker or concurrent subsystem event can orchestrate the timing to trigger memory corruption. The vulnerable component is the Bluetooth ISO connection tracking logic associated with hci_conn structures. Exploitation relies on inducing concurrent read and free operations on the iso_data pointer, potentially leading to denial of service through kernel panics or unpredictable system behavior."
}