CVE-2026-80914: Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

iso_conn_ready() looks up the BIS listener socket with iso_get_sock(),
which takes a reference, and then, without re-checking its state,
creates a child socket from it:

    parent = iso_get_sock(hdev, ...);
    if (!parent)
        return;

    lock_sock(parent);
    sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...);
    ...
    iso_chan_add(conn, sk, parent);
    ...
    release_sock(parent);
    sock_put(parent);

If the listener socket is closed concurrently, between iso_get_sock()
and lock_sock(), the reference taken by iso_get_sock() may be the last
one: the close path drops the link-list reference, and once
iso_conn_ready() drops its own reference at the end of the function the
socket is freed.  The child socket, however, is already linked to the
freed parent, and a later disconnect of the child runs iso_chan_del()
-> bt_accept_unlink(), which dereferences the dangling parent pointer
into the freed accept queue (a use-after-free).  The same dangling
pointer is also dereferenced through parent->***() in
iso_chan_del().

Fix it the same way the connected (non-BIS) path was fixed in commit
0d255e63fcf3 ("Bluetooth: ISO: hold sk properly in iso_conn_ready"):
after taking the socket lock, re-check that the parent is still a
listening, alive socket, and bail out otherwise.

The Linux kernel CVE team has assigned CVE-2026-80914 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.0 with commit ccf74f2390d60a2f9a75ef496d2564abb478f46a and fixed in 6.12.109 with commit 2387cd06a2c0b416f05028b02bba1089f54c28d9
	Issue introduced in 6.0 with commit ccf74f2390d60a2f9a75ef496d2564abb478f46a and fixed in 6.18.50 with commit 49fd7116f76b860b230843700fb7423ab5331e1f
	Issue introduced in 6.0 with commit ccf74f2390d60a2f9a75ef496d2564abb478f46a and fixed in 7.2.4 with commit 03288b7447c9e572f8ab82fc29cfb4ca719ab210
	Issue introduced in 6.0 with commit ccf74f2390d60a2f9a75ef496d2564abb478f46a and fixed in 7.3-rc1 with commit 560bef609fa5992745929e8d7d458b9d88dd2830

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-80914
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bluetooth/iso.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/2387cd06a2c0b416f05028b02bba1089f54c28d9
	https://git.kernel.org/stable/c/49fd7116f76b860b230843700fb7423ab5331e1f
	https://git.kernel.org/stable/c/03288b7447c9e572f8ab82fc29cfb4ca719ab210
	https://git.kernel.org/stable/c/560bef609fa5992745929e8d7d458b9d88dd2830