From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 17D0057EDAA for ; Wed, 9 Sep 2026 16:11:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788970272; cv=none; b=h+9U2PQ9I56OoARyTqu1w9/MC3E3OQPUgyg9No8q1qKvo28CDhpfiCAk008BuwqPgWC+RIlxxFyaBVFXiJCNlqQGcNSezSRC2J6l6RDTQ4alKH1tDg1nHnURWLZT7JXEDB91XDNfDZlYZDg6RzUN4Fy0ZtTu9MZM+415O+V332w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788970272; c=relaxed/simple; bh=Ieb3Uj9rXM7z4dbue9H1PUK9FBtuJcIb/iDbnli+fqY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ZskxbEiiiJhsHXePk4qzhEMzmJMPRirE+h44uGHdjjdgjgVFN3t6BLqHs5RQsUStti6N6c03yfe9mHbGQeQ3muKTSgO9AtWHt1wTHF9P0rPhAKwUSgGqvMGcQVh36fjLmgzshmxDE7Rq+VP3LxWk6u78n/jZoq8VujlD0zXnxIA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=HvYmWc0M; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="HvYmWc0M" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0888E1F00A3A; Wed, 9 Sep 2026 16:11:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788970270; bh=Nm7K2Gurdbpynq+yFURX1jktv5ygkheAmMBbk7EsLg4=; h=From:To:Cc:Subject:Date:Reply-To; b=HvYmWc0MJEs7dLaA3nMPOISU69hKeqIlSeIwaoRnHtlIFtGA2DKB293iGG3dd52Wf aXoInTP7E3fezdyUXTK3j3BHQqtS8jhmnmtvjtyGnSjUyZomBOS5/PiFHm4o95dvLg d2y5k3p4ZZXZ0mkgqN8oDHtj8wkfziRqcwVSVS2w= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-80914: Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Date: Wed, 9 Sep 2026 18:11:00 +0200 Message-ID: <2026090900-CVE-2026-80914-7e1f@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3567; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=RNuaiPs9hYkOFE/NG7DjT0Jvt3eqbTBYDeNB9JJSyBY=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkLW0WKdy6Tuidw8W78sjiXE3vecCzqnP1Nasvrn0euv nqo2SnxuiOWhUGQiUFWTJHlyzaeo/srDil6GdqehpnDygQyhIGLUwAmMukBw4IVKnecHy0q9Vvg dLFJTetcrekEI1mGBQsOBuXPsXj379/XOU+X+8WdO6XQKwwA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready iso_conn_ready() looks up the BIS listener socket with iso_get_sock(), which takes a reference, and then, without re-checking its state, creates a child socket from it: parent = iso_get_sock(hdev, ...); if (!parent) return; lock_sock(parent); sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...); ... iso_chan_add(conn, sk, parent); ... release_sock(parent); sock_put(parent); If the listener socket is closed concurrently, between iso_get_sock() and lock_sock(), the reference taken by iso_get_sock() may be the last one: the close path drops the link-list reference, and once iso_conn_ready() drops its own reference at the end of the function the socket is freed. The child socket, however, is already linked to the freed parent, and a later disconnect of the child runs iso_chan_del() -> bt_accept_unlink(), which dereferences the dangling parent pointer into the freed accept queue (a use-after-free). The same dangling pointer is also dereferenced through parent->***() in iso_chan_del(). Fix it the same way the connected (non-BIS) path was fixed in commit 0d255e63fcf3 ("Bluetooth: ISO: hold sk properly in iso_conn_ready"): after taking the socket lock, re-check that the parent is still a listening, alive socket, and bail out otherwise. The Linux kernel CVE team has assigned CVE-2026-80914 to this issue. Affected and fixed versions =========================== Issue introduced in 6.0 with commit ccf74f2390d60a2f9a75ef496d2564abb478f46a and fixed in 6.12.109 with commit 2387cd06a2c0b416f05028b02bba1089f54c28d9 Issue introduced in 6.0 with commit ccf74f2390d60a2f9a75ef496d2564abb478f46a and fixed in 6.18.50 with commit 49fd7116f76b860b230843700fb7423ab5331e1f Issue introduced in 6.0 with commit ccf74f2390d60a2f9a75ef496d2564abb478f46a and fixed in 7.2.4 with commit 03288b7447c9e572f8ab82fc29cfb4ca719ab210 Issue introduced in 6.0 with commit ccf74f2390d60a2f9a75ef496d2564abb478f46a and fixed in 7.3-rc1 with commit 560bef609fa5992745929e8d7d458b9d88dd2830 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-80914 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/bluetooth/iso.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/2387cd06a2c0b416f05028b02bba1089f54c28d9 https://git.kernel.org/stable/c/49fd7116f76b860b230843700fb7423ab5331e1f https://git.kernel.org/stable/c/03288b7447c9e572f8ab82fc29cfb4ca719ab210 https://git.kernel.org/stable/c/560bef609fa5992745929e8d7d458b9d88dd2830