Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in iso_conn After iso_conn_del(), ISO sockets should not dereference the hcon any more. Currently, clearing iso_conn::hcon relies on iso_conn_del() releasing the last reference to the iso_conn. Simplify this by explicitly clearing conn->hcon in iso_conn_del(), to avoid more complex reasoning on races about who holds the last reference.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-28T08:16:57.903Z",
  "pubdate": "2026-08-28T08:16:57.903Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel Bluetooth subsystem related to ISO (Isochronous) socket handling.\nThe issue stems from improper management of hcon (HCI connection) references within the iso_conn structure, specifically after the invocation of iso_conn_del().\nThis vulnerability allows for potential memory corruption or system instability if an ISO socket attempts to dereference an hcon pointer that has already been released or invalidated.\nThe flaw affects Linux kernel components managing Bluetooth ISO connections.\nAn attacker capable of triggering ISO connection teardowns while simultaneously interacting with the associated socket could potentially achieve a use-after-free scenario.\nThe risk includes kernel panic, denial of service, or potential arbitrary code execution depending on memory layout and race conditions.",
  "technicalDetails": "The vulnerability resides in the Bluetooth ISO connection management logic within the Linux kernel. The root cause is a dangling pointer reference within the iso_conn structure. Specifically, the iso_conn object maintains a reference to an hcon (HCI connection) object. Under certain operational flows, the iso_conn_del() function is called to perform cleanup and decrement reference counts.\nPreviously, the kernel relied on the assumption that iso_conn_del() would be the final consumer of the iso_conn structure, implicitly handling the cleanup of the hcon pointer. However, race conditions arise where the hcon reference remains in the iso_conn structure even after the reference count for the object has reached zero or the connection has been terminated. Consequently, subsequent operations on the ISO socket may attempt to dereference the stale hcon pointer.\nThe attack flow involves triggering a sequence of events where an ISO connection is being torn down while another thread or process is actively accessing or checking the state of the associated ISO socket. By winning the race condition, an attacker can ensure that the execution path reaches a dereference operation on the dangling hcon pointer after the underlying memory has been freed or reassigned.\nThe exploitability relies on the timing of kernel scheduling and the ability to manipulate the state of the ISO connection. Successful exploitation leads to a use-after-free scenario, which is a significant memory safety violation. In the context of the Linux kernel, this often results in immediate system crashes (kernel panic) resulting in a Denial of Service. In more sophisticated scenarios, if the attacker can influence the heap allocation that replaces the freed memory, it may be possible to influence control flow or leak sensitive kernel information.\nThe fix involves explicitly setting conn->hcon to NULL during the execution of iso_conn_del(). This defensive programming practice ensures that the pointer is invalidated immediately upon connection deletion, effectively neutralizing any attempts to access the stale reference in concurrent execution flows and removing the reliance on complex reference counting logic to prevent the dangling pointer state."
}