CVE-2026-99013

The Linux kernel contains a vulnerability in the Bluetooth ISO stack where concurrent listen() calls on the same broadcast socket can lead to a use-after-free condition. This occurs because iso_sock_listen() drops the socket lock before calling iso_listen_bis() to maintain lock ordering. Conseque...

EUVD-2026-108807

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup isosocklisten drops the socket lock before calling isolistenbis to preserve the hdev-lock ordering. Two concurrent listen calls on the same broadcast socket can therefore both...