Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99013— Bluetooth: ISO: Reject concurrent BIS listener setup

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已被修复： 蓝牙：ISO：拒绝并发的 BIS 监听器配置 在调用 之前会释放 socket 锁，以维持 的加锁顺序。因此，针对同一个广播 socket 的两个并发 调用都可能观察到 状态。调用者 A 可以附加连接 并释放锁，随后调用者 B 可以获取锁并在 A 发布 状态之前附加连接 。 会检查 是否已关联 socket，但并未检查该 socket 是否已关联其他连接。第二次附加操作会覆盖 ，导致 的引用发生泄漏，同时 保持不变。由于 socket 的销毁流程跟随 ，后续发生在 上的事

CVSS 7.8 · High EPSS 0.16% · P5

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 11

VendorProduct Version RangeStatus
Linux Linux c541d7b5e17987ed330798b07d4ad508859c1c93< 559e4d2b6f83aaa96061659cc7104b7a0293f9ef affected
168e28305b871d8ec604a8f51f35467b8d7ba05b< 90b744066ca520d1a6a505a11ade9c9a5f48accf affected
168e28305b871d8ec604a8f51f35467b8d7ba05b< 79993e9919a87068183ba3622c383f05c049c4bc affected
168e28305b871d8ec604a8f51f35467b8d7ba05b< 555ff78fa719f50ff4cdbdb40aa1acc6e8e327d3 affected
6.12.6< 6.12.113 affected
6.13 affected
< 6.13 unaffected
6.12.113≤ 6.12.* unaffected
… +3 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99013

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Bluetooth: ISO: Reject concurrent BIS listener setup
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup iso_sock_listen() drops the socket lock before calling iso_listen_bis() to preserve the hdev->lock ordering. Two concurrent listen() calls on the same broadcast socket can therefore both observe BT_BOUND. Caller A can attach connA and release the locks, then caller B can acquire them and attach connB before A publishes BT_LISTEN. __iso_chan_add() checks whether connB already has a socket, but not whether the socket already has a connection. The second attachment overwrites iso_pi(sk)->conn, leaking the connA reference and leaving connA->sk intact. Socket teardown follows connB, so later events on connA can cause a stale socket access. Recheck BT_BOUND and require iso_pi(sk)->conn to be NULL after taking both the HCI device and socket locks in iso_listen_bis(). The connection check also covers the interval between attachment and publication of BT_LISTEN. Reject a competing setup with -EBADFD through the existing unlock path before allocating another connection. A recorded KASAN report from an instrumented kernel shows: BUG: KASAN: slab-use-after-free in iso_sock_hold+0x119/0x1f0 Call Trace: iso_sock_hold+0x119/0x1f0 iso_conn_del+0xe4/0x270 hci_disconn_complete_evt+0x351/0x8c0 hci_event_packet+0x71b/0xb20 hci_rx_work+0x293/0x730 Allocated by task 93: sk_prot_alloc+0x113/0x220 sk_alloc+0x2b/0x6d0 bt_sock_alloc+0x29/0x370 iso_sock_alloc.constprop.0+0x19/0x300 iso_sock_create+0x94/0x100 Freed by task 93: kfree+0x121/0x3c0 __sk_destruct+0x42b/0x540 iso_sock_release+0x29d/0x340 __sock_release+0xa1/0x260 sock_close+0x10/0x20
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux c541d7b5e17987ed330798b07d4ad508859c1c93 ~ 559e4d2b6f83aaa96061659cc7104b7a0293f9ef -
Linux Linux 6.13 -

II. Public POCs for CVE-2026-99013

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99013

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99013 (4)

Same Patch Batch · Linux · 2026-10-23 · 217 CVEs total

CVE-2026-98959 9.8 CRITICAL btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99078 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99079 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-98988 8.8 HIGH namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-99083 8.8 HIGH ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082 8.8 HIGH KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98870 8.8 HIGH ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98980 8.8 HIGH namei: don't reveal overmounted entries in refwalk
CVE-2026-98981 8.8 HIGH namespace: unhash a dentry before detaching the mounts on it
CVE-2026-99042 8.4 HIGH io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-98978 8.4 HIGH namespace: never expire a locked mount
CVE-2026-99064 8.1 HIGH cipso: adjust cached option offsets when removing CIPSO
CVE-2026-98968 8.1 HIGH amt: send the relay's General Query directly from the receive path
CVE-2026-98899 7.8 HIGH netfilter: ipset: mark the rcu locked areas properly
CVE-2026-99012 7.8 HIGH Bluetooth: ISO: Serialize concurrent connect calls
CVE-2026-99016 7.8 HIGH riscv: futex: untag the user pointer before the atomic access
CVE-2026-99002 7.8 HIGH drm/vmwgfx: validate pitch coming from userspace
CVE-2026-99006 7.8 HIGH drm/i915/gem: Prevent overstepping exec array boundary
CVE-2026-98999 7.8 HIGH drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
CVE-2026-99032 7.8 HIGH net/smc: protect clcsock lifetime in smc_getname

Showing top 20 of 217 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux