Linux Kernel CVE-2026-80721

Exploitation requires the attacker to be within Bluetooth radio range (typically 10-100 meters depending on hardware class) - this is the primary physical constraint limiting exposure. The Bluetooth ISO subsystem must be active on the target, meaning Bluetooth must be enabled and the btiso module loaded; this is not default on server deployments but is common on desktop/laptop systems. The race condition is triggered during ISO connection teardown while concurrent ISO socket operations are in progress, requiring timing precision that increases attack complexity beyond what CVSS AC:L implies. No authentication is required from the attacker's side to initiate the Bluetooth interaction. Systems that never use Bluetooth ISO (most servers, headless deployments) are not exploitable even if the vulnerable kernel is running.

The NVD CVSS score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) presents an optimistic attacker view: the adjacent network vector is accurate for Bluetooth, but the AC:L assessment likely understates the race-condition timing complexity inherent in triggering a use-after-free through concurrent ISO connection teardown and socket operations. The EPSS score of 0.15% at the 5th percentile is notably low for an 8.8 CVSS - this divergence signals the vulnerability is technically severe if exploited but practically difficult to weaponize, consistent with kernel race conditions requiring precise timing. No public POC exists, and the vulnerability is absent from CISA KEV. Real-world risk is therefore moderate-to-low in the near term: the Bluetooth ISO feature must be active (used for LE Audio), the attacker must be physically adjacent, and exploitation requires triggering specific kernel race conditions. The primary realistic impact is a kernel panic (denial of service) rather than reliable code execution.

An attacker within Bluetooth radio range of a vulnerable Linux host (e.g., a laptop running a kernel before 7.1.8 with Bluetooth ISO enabled) initiates or manipulates ISO connection teardown while concurrently racing ISO socket operations, triggering the dangling hcon pointer dereference. The most likely outcome is a kernel panic and system crash; in a highly controlled scenario with precise timing, kernel memory corruption could potentially be leveraged for privilege escalation. No public POC exists, making opportunistic exploitation unlikely at present.