Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of iso_conn iso_conn_del() and iso_chan_del() have a race that results to double-put of iso_conn: [Task hdev->workqueue] [Task 2] iso_conn_del iso_chan_del iso_conn_hold_unless_zero iso_conn_lock iso_conn_lock conn->sk = NULL iso_conn_unlock sk = iso_sock_hold(conn) <---------´ if (!sk) iso_conn_put iso_conn_put iso_conn_put /* UAF */ The extra put for !sk in iso_conn_del() is currently required since failing iso_chan_add() may leave iso_conn not associated with any sk. Fix by having iso_pi(sk)->conn own refcount when non-NULL, so iso_conn_del does not need to put it. Adjust the iso_conn_add() refcounting so that conn is put if it does not get associated with an sk.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:17:58.700Z",
  "pubdate": "2026-08-15T13:17:58.700Z",
  "executiveSummary": "A race condition vulnerability exists in the Linux kernel's Bluetooth subsystem concerning isochronous connection (iso_conn) reference counting. The flaw specifically arises within the concurrent execution paths of iso_conn_del() and iso_chan_del().\nThis vulnerability leads to a double-put scenario on the iso_conn object, resulting in a use-after-free (UAF) condition and memory corruption within the kernel space.\nThe affected system/product is the Linux kernel, specifically within the Bluetooth ISO implementation.\nThe risk implications include potential kernel memory corruption, denial of service (system crashes), and theoretical avenues for local privilege escalation if an attacker can reliably control the freed memory structure.\nAttacker capabilities require local execution access or the ability to trigger specific Bluetooth management operations that induce concurrent deletion of ISO channels and connections.\nExploitation requirements include timing precision to win the race condition between the hdev workqueue task and secondary tasks executing concurrent socket and connection deletions.",
  "technicalDetails": "The vulnerability resides in the Linux kernel Bluetooth subsystem, specifically in the management of isochronous connections handled by iso_conn_del() and iso_chan_del() functions.\nThe root cause is a race condition resulting from improper reference counting logic. Under concurrent execution, task hdev->workqueue executing iso_conn_del can interleave with Task 2 executing iso_chan_del. Specifically, iso_conn_del attempts to hold the connection via iso_conn_hold_unless_zero, acquires the lock, and checks socket association. Meanwhile, iso_chan_del acquires the lock, sets conn->sk = NULL, releases the lock, and invokes iso_conn_put. Subsequently, the first task proceeds to call iso_sock_hold(conn), finds no associated socket (!sk), and drops an additional reference via iso_conn_put.\nThis redundant reference decrementing (double-put) causes the reference count of iso_conn to drop to zero prematurely while pointers to the structure may still be active or referenced elsewhere, directly introducing a use-after-free (UAF) vulnerability.\nThe vulnerable component is the Bluetooth ISO connection and channel handling logic, which historically required an extra put for !sk in iso_conn_del() to account for failing iso_chan_add() calls leaving an iso_conn disassociated from any socket.\nThe attack flow requires triggering the concurrent execution of iso_conn_del() and iso_chan_del() paths. When successfully raced, the kernel executes conflicting reference drops on the shared iso_conn structure.\nPrivilege requirements: Local execution access or the capability to interact with the Bluetooth subsystem sockets and interfaces is generally required to trigger the specific connection teardown sequences.\nNetwork exposure: Affects local Bluetooth stack operations, which can potentially be triggered locally or via malicious Bluetooth interactions depending on the specific driver and interface exposure.\nPost-exploitation impact includes kernel panics, denial of service due to memory corruption, and undefined kernel behavior typical of use-after-free vulnerabilities in core subsystems."
}