Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_connect_ind Accessing iso_pi(sk)->conn requires lock_sock, which is not taken in the "ev3" part of iso_connect_ind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before locking. Fix by adding lock/release. Recheck hcon is valid after lock acquire where needed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:17:59.137Z",
  "pubdate": "2026-08-15T13:17:59.137Z",
  "executiveSummary": "A concurrency vulnerability exists within the Linux kernel Bluetooth subsystem's Isochronous (ISO) channel handling implementation, specifically in the iso_connect_ind function.\nThe vulnerability is classified as a concurrency control and locking flaw, resulting from missing socket locking mechanisms when accessing the iso_pi(sk)->conn pointer.\nThe primary impact of this flaw includes potential null pointer dereferences, kernel memory corruption, and undefined behavior, which could lead to a localized denial of service (DoS) or potentially arbitrary kernel execution depending on memory layout and timing.\nAffected systems include any Linux kernel deployments utilizing Bluetooth ISO channels where unmitigated connection indication handling occurs.\nRisk implications center on kernel stability and potential system crashes triggered by malicious or malformed Bluetooth connection events.\nAttacker capabilities require the ability to interact with the target system's Bluetooth layer, typically within local radio proximity or via crafted HCI packets, to manipulate connection states during the race condition window.\nExploitation requirements rely on precise timing conditions to trigger the state transition of the socket away from LISTEN or CONNECT states concurrently with the connection indication event.",
  "technicalDetails": "The vulnerability resides in the Linux kernel Bluetooth subsystem, specifically within the connection indication handler function designated as iso_connect_ind.\nThe root cause of the vulnerability is the absence of proper synchronization primitives, specifically the omission of the lock_sock mechanism, when accessing the underlying connection structure pointer via iso_pi(sk)->conn within the 'ev3' execution path of iso_connect_ind.\nFurthermore, the socket state may dynamically transition away from the expected LISTEN or CONNECT states during the asynchronous window before locking can be established, leading to a condition where iso_pi(sk)->conn evaluates to NULL.\nThe attack flow proceeds as follows: an attacker initiates or simulates asynchronous Bluetooth ISO connection events designed to coincide with socket state teardowns or transitions. As iso_connect_ind processes the 'ev3' event path without holding the requisite socket lock, the kernel attempts to dereference iso_pi(sk)->conn.\nBecause the socket state may have changed and the pointer can be NULL, or because concurrent threads manipulate the socket state without mutual exclusion, a null pointer dereference or a use-after-free style race condition occurs.\nVulnerable components include the Bluetooth ISO protocol handler implementation within the Linux kernel network stack. The exposure is tied to the Bluetooth stack's handling of incoming connection indications.\nAuthentication and privilege requirements for local exploitation depend on the system's Bluetooth configuration, but typically malicious proximity interaction or compromised local execution context capable of injecting HCI events can trigger the flaw.\nNetwork exposure is restricted to the Bluetooth medium or local socket interfaces capable of generating ISO connection primitives.\nPost-exploitation impact is primarily manifested as a kernel panic resulting from the null pointer dereference, causing an immediate denial of service of the affected host system."
}