Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket using isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from i...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling The Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT or ISOEND packets. Currently, we reject them if they are the last packet. If the controller sends a...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race between kfree and krefgetunlesszero hciconn::isodata is accessed and modified without a lock or RCU protection. This results in a race condition Task hdev-workqueue Task 2 isorecv isoconnputconn conn = LO...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of isoconn isoconndel and isochandel have a race condition that leads to a double-put of isoconn: Task hdev-workqueue Task 2 isoconndel isochandel isoconnholdunlesszero isoconnlock isoconnlock...

CVE-2026-80761

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. The isosockgetname function fails to properly initialize the sockaddriso structure before returning it. This oversight allows an unprivileged attacker to read uninitialized kernel stack memory, leading to information disclosure...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions from 6.12.6 up to but including 6.12.113 and version 6.13. This vulnerability stems from the Bluetooth ISO subsystem failing to properly validate socket connection states when setting up concurrent BIS listeners. Subsequent connections can...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.1.178 and prior to 6.6.145. This vulnerability stems from the Bluetooth ISO failing to verify whether a service UUID is the Basic Audio Announcement Service UUID; as a result, Periodic Advertisement Report data may be incorrectly...

CVE-2026-80914

A flaw was found in the Bluetooth ISO subsystem of the Linux kernel. A use-after-free vulnerability can occur in the isoconnready function if a listener socket is closed concurrently while a child socket is being created. This can lead to a dangling pointer being dereferenced upon a later...

Linux Kernel Security Vulnerabilities

Versions of the Linux kernel from 6.6.67 to 6.6.158 and 6.8 contain security vulnerabilities. These vulnerabilities stem from an issue with the hcibindbis function in Bluetooth ISO, which fails to properly balance the reference counts of parent connections. This leads to the discarding of existin...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.6 contains security vulnerabilities. These vulnerabilities stem from the Bluetooth ISO not releasing unused CIS-held references after channel attachment, which may lead to resource leaks...

kernel: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream subsystem. A race condition exists where the isosockcleartimer function can access connection data without proper locking, while another function, isoconndel, concurrently modifies the same data. This can lead to a NULL point...

kernel: Bluetooth: ISO: fix UAF in iso_recv_frame

A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream subsystem. This vulnerability, known as a Use-After-Free, occurs because the system attempts to use a memory area after it has been released, which can lead to unpredictable behavior. A malicious actor could potentially explo...

AZL-99959 CVE-2026-80914 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

CVE-2026-80914

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

DEBIAN-CVE-2026-80914

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

EUVD-2026-75088

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

CVE-2026-80914 Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

CVE-2026-80914

CVE-2026-80914 is a use-after-free vulnerability in the Linux kernel's Bluetooth ISO subsystem , specifically in the iso_conn_ready() function. When a BIS listener socket is closed concurrently between iso_get_sock() and lock_sock(), the socket may be freed while a child socket remains linked to ...

Linux Distros Unpatched Vulnerability : CVE-2026-80914

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, a...

PT-2026-89084

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Bluetooth ISO implementation. The iso conn ready function retrieves a BIS listener socket using iso get sock and creates a child socket without...