Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80914— Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux 内核中，以下漏洞已修复： 蓝牙：ISO：修复 iso_conn_ready 中监听套接字的释放后使用（use-after-free）问题 通过 查找 BIS 监听套接字。该函数会获取一个引用，随后在未重新检查其状态的情况下，便基于该套接字创建子套接字： 如果在 和 之间，监听套接字被并发关闭，那么 获取的引用可能成为最后一个引用：关闭路径会释放链接列表的引用，而当 在函数末尾释放其自身引用时，该套接字即被释放。然而，子套接字已经链接到这个已释放的父套接字，随后子套接字的断开操作会调用 -> ，从而解引用

AI Predicted 7.8 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1531 · Account Access Removal

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux ccf74f2390d60a2f9a75ef496d2564abb478f46a< 2387cd06a2c0b416f05028b02bba1089f54c28d9 affected
ccf74f2390d60a2f9a75ef496d2564abb478f46a< 49fd7116f76b860b230843700fb7423ab5331e1f affected
ccf74f2390d60a2f9a75ef496d2564abb478f46a< 03288b7447c9e572f8ab82fc29cfb4ca719ab210 affected
ccf74f2390d60a2f9a75ef496d2564abb478f46a< 560bef609fa5992745929e8d7d458b9d88dd2830 affected
6.0 affected
< 6.0 unaffected
6.12.109≤ 6.12.* unaffected
6.18.50≤ 6.18.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80914

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready iso_conn_ready() looks up the BIS listener socket with iso_get_sock(), which takes a reference, and then, without re-checking its state, creates a child socket from it: parent = iso_get_sock(hdev, ...); if (!parent) return; lock_sock(parent); sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...); ... iso_chan_add(conn, sk, parent); ... release_sock(parent); sock_put(parent); If the listener socket is closed concurrently, between iso_get_sock() and lock_sock(), the reference taken by iso_get_sock() may be the last one: the close path drops the link-list reference, and once iso_conn_ready() drops its own reference at the end of the function the socket is freed. The child socket, however, is already linked to the freed parent, and a later disconnect of the child runs iso_chan_del() -> bt_accept_unlink(), which dereferences the dangling parent pointer into the freed accept queue (a use-after-free). The same dangling pointer is also dereferenced through parent->***() in iso_chan_del(). Fix it the same way the connected (non-BIS) path was fixed in commit 0d255e63fcf3 ("Bluetooth: ISO: hold sk properly in iso_conn_ready"): after taking the socket lock, re-check that the parent is still a listening, alive socket, and bail out otherwise.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux ccf74f2390d60a2f9a75ef496d2564abb478f46a ~ 2387cd06a2c0b416f05028b02bba1089f54c28d9 -
Linux Linux 6.0 -

II. Public POCs for CVE-2026-80914

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80914

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80914 (4)

Same Patch Batch · Linux · 2026-09-09 · 12 CVEs total

CVE-2026-80925 vlan: fix skb_under_panic and races when toggling HW VLAN offload
CVE-2026-80924 crypto: krb5 - use kfree_sensitive() for derived key buffers
CVE-2026-80923 xhci: dbgtty: Fix unregister on tty_register_driver() failure
CVE-2026-80922 crypto: qcom-rng - Allow zero as a random number
CVE-2026-80921 KVM: s390: vsie: zero stale crypto bits
CVE-2026-80920 io_uring: defer eventfd signaling when queued from a wakeup handler
CVE-2026-80919 drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format
CVE-2026-80918 HID: core: fix number/pointer type confusion on long items
CVE-2026-80917 PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
CVE-2026-80916 kcov: fix data corruption and race conditions on PREEMPT_RT
CVE-2026-80915 drm/xe: Fix DPT allocation paths.

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80914

No comments yet

Leave a comment