Skip to main content

Linux Kernel CVE-2026-53276

| EUVDEUVD-2026-39227 HIGH
Use After Free (CWE-416)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-h5cp-pgfw-22wh
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local low-privilege attacker (AV:L/PR:L); AC:H because triggering the UAF requires winning a narrow concurrency race; kernel UAF yields high C/I/A via likely memory corruption.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jun 28, 2026 - 09:52 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.8
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer

In iso_sock_rebind_bc(), the bis pointer is cached, then the socket lock is dropped: bis = iso_pi(sk)->conn->hcon; /* Release the socket before lookups since that requires hci_dev_lock

  • which shall not be acquired while holding sock_lock for proper
  • ordering.

*/ release_sock(sk); hci_dev_lock(bis->hdev);

During the unlocked window, could a concurrent close() destroy the connection and free the bis structure, causing hci_dev_lock(bis->hdev) to access memory after it is freed, fix this by using the hdev reference which was safely acquired via iso_conn_get_hdev().

AnalysisAI

Local privilege escalation potential via a use-after-free in the Linux kernel's Bluetooth ISO (Isochronous) subsystem affects kernels through 6.19 and related stable trees. In iso_sock_rebind_bc(), the code caches the hci_conn pointer (bis) and then drops the socket lock to acquire hci_dev_lock; a concurrent close() during this unlocked window can destroy the connection and free the bis structure, so the subsequent hci_dev_lock(bis->hdev) dereferences freed memory. There is no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile), but a kernel UAF reachable by a local user warrants timely patching.

Technical ContextAI

The flaw is in the kernel Bluetooth stack's ISO socket handling (net/bluetooth/iso.c), specifically the broadcast rebind path iso_sock_rebind_bc(). ISO sockets support LE Audio / Broadcast Isochronous Streams. The root cause is a classic use-after-free (CWE-416) driven by a lock-ordering race: hci_dev_lock must not be held while sock_lock is held, so the function deliberately releases the socket lock before taking the device lock. During that gap, the cached hci_conn (bis) and its parent hdev can be torn down by a parallel close()/connection teardown, leaving a dangling pointer. The fix replaces use of the cached bis->hdev with an hdev reference safely obtained earlier via iso_conn_get_hdev(), ensuring the device object remains valid across the unlocked window.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel.org stable fixes referenced by commits d324b8aa20bd3c3394e3647dc22491d88f3f4e7a and f50331f2a1441ec49988832c3a95f2edacc47322 (https://git.kernel.org/stable/c/d324b8aa20bd3c3394e3647dc22491d88f3f4e7a and https://git.kernel.org/stable/c/f50331f2a1441ec49988832c3a95f2edacc47322), or upgrade to the patched kernel package shipped by your distribution once it incorporates these commits, then reboot. Where immediate patching is not possible, reduce attack surface by disabling the Bluetooth stack if unused (blacklist the bluetooth/hci modules or stop bluetoothd and rmmod the modules), which fully removes reachability of the ISO socket path at the cost of losing all Bluetooth functionality; alternatively restrict local untrusted-user access (avoid granting shells/containers to untrusted users on affected hosts), noting this does not protect against a malicious authenticated local user. Track distribution advisories via https://vuldb.com/vuln/373831 and https://nvd.nist.gov/vuln/detail/CVE-2026-53276 for exact fixed package versions.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53276 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy