Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: clear iso_data always when detaching conn from hcon When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is necessary, otherwise later iso_conn_free() will UAF. Fix clearing of iso_data in iso_sock_disconn() Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on iso_sock_release() followed by hci_abort_conn_sync().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:17:59.443Z",
  "pubdate": "2026-08-15T13:17:59.443Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel Bluetooth subsystem's ISOC (Isochronous) implementation, specifically within socket disconnection and connection handling logic.\nThe vulnerability type is a Use-After-Free (UAF), which can lead to system crashes, denial of service, or potentially arbitrary code execution within the kernel context.\nThe affected system is the Linux kernel, specifically impacting Bluetooth ISO socket and connection management functions like iso_sock_disconn(), iso_conn_free(), and iso_conn_hold_unless_zero().\nRisk implications include kernel panic and memory corruption resulting from dangling pointers being accessed after the underlying memory structure has been freed.\nAttacker capabilities involve triggering memory management race conditions or sequence flows via local Bluetooth operations, specifically involving an iso_sock_release() operation immediately followed by hci_abort_conn_sync().\nExploitation requirements include the ability to execute local code or manipulate Bluetooth socket operations to trigger the specific detach and release sequence.",
  "technicalDetails": "The root cause of the vulnerability resides in the improper management of internal pointer references when detaching an ISOC connection (iso_conn) from the HCI connection (hcon).\nDuring the disconnection phase in iso_sock_disconn(), the connection pointer conn->hcon is set to NULL, but the associated reference stored in conn->hcon->iso_data is not cleared or reset.\nBecause the stale pointer persists, subsequent operations such as iso_conn_free() or iso_conn_hold_unless_zero() attempt to access the memory location previously occupied by the ISO data structure after it has already been deallocated.\nThe specific attack flow involves initiating an iso_sock_release() followed immediately by an hci_abort_conn_sync() command.\nThis sequence causes the kernel to free the underlying memory structures while stale references still point to them, triggering a KASAN (Kernel Address Sanitizer) slab-use-after-free report inside iso_conn_hold_unless_zero.\nThe vulnerable component is the Bluetooth subsystem's ISOC layer within the Linux kernel, affecting functions handling socket teardown and HCI connection detachment.\nNo specific authentication or remote network exposure is strictly required if local execution or local Bluetooth interface access is leveraged, aligning with typical local kernel exploitation vectors.\nPost-exploitation impact includes kernel instability, Denial of Service (DoS) via kernel panics, and potential kernel memory corruption depending on heap layout manipulation."
}