Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_sock_getname Accessing iso_pi(sk)->conn requires lock_sock, which is not held here. Fix by adding the lock/release.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-08-15T13:17:59.233Z",
  "pubdate": "2026-08-15T13:17:59.233Z",
  "executiveSummary": "A concurrency vulnerability exists in the Linux kernel Bluetooth subsystem involving the ISO socket implementation.\nSpecifically, the vulnerability arises due to the lack of proper socket locking mechanisms when accessing connection pointers via iso_pi(sk)->conn within the iso_sock_getname function.\nThe primary impact of this flaw includes potential race conditions, memory corruption, and undefined kernel behavior, which could potentially lead to denial of service or local privilege escalation depending on system state and memory layout.\nThe affected system is the Linux kernel, specifically the Bluetooth ISO socket layer.\nExploitation requires a local attacker with the capability to execute code or interact with Bluetooth sockets on the target system, leveraging concurrent access to trigger the synchronization failure.\nThe risk implication is moderate to high, as kernel-level race conditions compromise the stability and integrity of the operating system.",
  "technicalDetails": "The vulnerability is rooted in a synchronization oversight within the Linux kernel Bluetooth subsystem, specifically in the ISO socket handling logic.\nThe vulnerable component is the iso_sock_getname function located within the Bluetooth ISO protocol handler.\nThe root cause is the absence of the required socket locking primitive (lock_sock) when reading or manipulating the iso_pi(sk)->conn member structure.\nIn the Linux kernel socket architecture, accessing protocol-specific socket data structures that manage connection states typically requires holding the socket lock to prevent concurrent modifications from multiple threads or interrupt contexts.\nWithout invoking lock_sock prior to accessing iso_pi(sk)->conn in iso_sock_getname, a race condition occurs if another thread concurrently modifies, closes, or frees the underlying connection structure.\nAn attacker or local application can exploit this by initiating concurrent system calls, such as repeatedly querying socket names via getsockname while simultaneously establishing or tearing down Bluetooth ISO connections.\nThis race condition can lead to use-after-free conditions, null pointer dereferences, or invalid memory reads within kernel space.\nThe affected versions encompass any Linux kernel build containing the vulnerable iso_sock_getname implementation without the proper locking primitives.\nExploitation requires local execution capabilities and access to create Bluetooth sockets, though it does not necessitate specialized privileges beyond standard user capabilities to open socket descriptors.\nPost-exploitation impact typically manifests as a kernel panic resulting in a denial of service, though theoretical memory corruption vectors could be leveraged by sophisticated adversaries for privilege escalation."
}