Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout iso_sock_timeout() takes lock_sock, so sync disabling the timer while holding that lock may deadlock. iso_sock_timeout() may also run concurrently with iso_conn_del(), which leads to UAF [Task 1] [Task hdev->workqueue] iso_sock_timeout iso_conn_del iso_conn_hold_unless_zero iso_chan_del `------------> iso_conn_put caller frees hcon iso_conn_put iso_conn_free conn->hcon->iso_data = NULL; /* UAF */ Fix the deadlock by removing the disable from the lock_sock sections. Move the timer from iso_conn to iso_pinfo to decouple it from iso_conn which may need to be freed in lock_sock section. Convert some of the clear_timer to disable_timer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:17:58.837Z",
  "pubdate": "2026-08-15T13:17:58.837Z",
  "executiveSummary": "A vulnerability has been identified in the Linux kernel Bluetooth subsystem involving the ISO socket and connection management handling. Specifically, the flaw stems from improper locking mechanisms and lifetime management within iso_sock_timeout() and iso_conn_del().\nThe vulnerability type encompasses a deadlock condition combined with a Use-After-Free (UAF) memory safety issue. The impact allows a local attacker to potentially trigger kernel deadlocks, leading to a denial of service (DoS), or exploit race conditions resulting in memory corruption and unpredictable kernel behavior.\nThe affected product is the Linux kernel, specifically within the Bluetooth ISO implementation components including the functions iso_sock_timeout() and iso_conn_del().\nRisk implications include potential local denial of service via kernel lock contention or memory corruption vulnerabilities that could compromise kernel integrity. Attacker capabilities require local execution access to trigger specific Bluetooth ISO socket timeout and connection deletion race conditions.\nNo specific remote exploitation vectors or authentication requirements beyond local system access are detailed in the resolution context, relying instead on concurrent task execution logic within the kernel space.",
  "technicalDetails": "The vulnerability root cause resides in concurrency flaws and improper lock scoping within the Linux kernel Bluetooth ISO socket handling routines, namely iso_sock_timeout() and iso_conn_del().\nDuring execution, iso_sock_timeout() acquires lock_sock while synchronously attempting to disable a timer, creating a classic deadlock scenario when lock contention intersects with timer cleanup operations.\nFurthermore, a race condition exists between Task 1 executing iso_sock_timeout() and Task hdev->workqueue executing iso_conn_del(). Task 1 invokes iso_conn_hold_unless_zero(), after which iso_conn_del() calls iso_chan_del and iso_conn_put, causing the caller to free the underlying hcon structure.\nSubsequently, when Task 1 resumes and calls iso_conn_put leading to iso_conn_free, it attempts to access conn->hcon->iso_data = NULL;, resulting in a Use-After-Free (UAF) condition because the hcon memory has already been deallocated.\nThe vulnerable components are the Bluetooth ISO protocol handler functions and data structures, specifically iso_sock and iso_conn structures within the Linux kernel Bluetooth subsystem.\nThe attack flow requires concurrent execution paths where a socket timeout function runs simultaneously with connection deletion routines managed by the hdev->workqueue. This induces the UAF window where the connection reference is dropped and freed while still referenced by the timing execution context.\nExploitation leads directly to kernel memory corruption via UAF writes or system hangs/freezes via deadlocks, severely impacting system stability and availability."
}