Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready iso_conn_ready() looks up the BIS listener socket with iso_get_sock(), which takes a reference, and then, without re-checking its state, creates a child socket from it: parent = iso_get_sock(hdev, ...); if (!parent) return; lock_sock(parent); sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...); ... iso_chan_add(conn, sk, parent); ... release_sock(parent); sock_put(parent); If the listener socket is closed concurrently, between iso_get_sock() and lock_sock(), the reference taken by iso_get_sock() may be the last one: the close path drops the link-list reference, and once iso_conn_ready() drops its own reference at the end of the function the socket is freed. The child socket, however, is already linked to the freed parent, and a later disconnect of the child runs iso_chan_del() -> bt_accept_unlink(), which dereferences the dangling parent pointer into the freed accept queue (a use-after-free). The same dangling pointer is also dereferenced through parent->***() in iso_chan_del(). Fix it the same way the connected (non-BIS) path was fixed in commit 0d255e63fcf3 ("Bluetooth: ISO: hold sk properly in iso_conn_ready"): after taking the socket lock, re-check that the parent is still a listening, alive socket, and bail out otherwise.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-09T17:17:46.263Z",
  "pubdate": "2026-09-09T17:17:46.263Z",
  "executiveSummary": "A critical race condition vulnerability has been identified in the Linux kernel's Bluetooth subsystem, specifically within the handling of Broadcast Isochronous Streams (BIS) listener sockets. The flaw manifests as a Use-After-Free (UAF) vulnerability inside the iso_conn_ready function. This issue arises because the kernel fails to validate the state of a listener socket after acquiring its lock, allowing a concurrent socket close operation to free the parent structure while a child socket still maintains a reference to it.\nIf successfully exploited, this vulnerability can result in a kernel crash, leading to a local Denial of Service (DoS), or potentially allow for arbitrary code execution with elevated kernel privileges. To exploit the flaw, an attacker must have local access or the ability to manipulate Bluetooth socket states to trigger the precise race condition. Affected systems include those running Linux kernels with Bluetooth ISO protocol support enabled.",
  "technicalDetails": "The vulnerability resides in the iso_conn_ready function within net/bluetooth/iso.c. This function manages the establishment of Bluetooth ISO connections by identifying a parent listener socket and spawning a corresponding child socket. The function retrieves the parent socket using iso_get_sock, which increments the socket's reference count to ensure it remains allocated during initial processing.\nHowever, a Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the retrieval of the socket and the acquisition of its lock via lock_sock. The execution flow unfolds as follows:\n1. The kernel calls parent = iso_get_sock(hdev, ...) to locate the Broadcast Isochronous Stream (BIS) listener socket.\n2. Before lock_sock(parent) is executed, a concurrent thread closes the listener socket. The socket close sequence drops the link-list reference to the parent socket.\n3. Although the parent socket is marked for closure, its memory is not freed immediately because iso_conn_ready still holds an active reference.\n4. The iso_conn_ready function acquires the lock using lock_sock(parent) but does not re-check the state of the socket to verify if it is still a valid, active listener.\n5. It proceeds to allocate a child socket using iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...) and links the child to the parent via iso_chan_add(conn, sk, parent).\n6. At the end of the execution flow, the function releases the lock via release_sock(parent) and decrements its reference using sock_put(parent).\nBecause the concurrent close path had already dropped the other references, this final sock_put drops the reference count to zero, resulting in the parent socket being freed from memory. The newly created child socket, however, still retains a dangling parent pointer pointing to this freed memory address.\nWhen the child socket is subsequently disconnected, the kernel executes the cleanup path via iso_chan_del -> bt_accept_unlink. These functions attempt to dereference the dangling parent pointer to access the accept queue and perform other cleanup operations (such as parent->***() calls). This dereference of a freed structure triggers a Use-After-Free (UAF) condition, which can cause kernel memory corruption or execute arbitrary payload instructions if the freed memory has been reallocated by an attacker.\nThe remediation, similar to the connected-path fix in commit 0d255e63fcf3, requires modifying iso_conn_ready to re-verify that the parent socket remains in the listening state and is alive immediately after lock_sock(parent) is called, safely bailing out if the socket state is invalid."
}