EUVD-2026-108806
GHSA-g55x-63cp-x552
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access with Bluetooth ISO socket capability
-
DeliveryOpen multiple ISO sockets and issue concurrent connects
-
ExploitWin race on unlocked socket state
-
ExecutionTrigger use-after-free in iso_conn_del/iso_sock_hold
-
ImpactCorrupt kernel memory for privilege escalation
Vulnerability Assessment
| Exploitation Conditions | Requires a local attacker running code on the host with the ability to open AF_BLUETOOTH ISO sockets and issue multiple concurrent iso_sock_connect() calls to win the time-of-check/time-of-use race in the socket state check. Preconditions: the kernel must be built with and running Bluetooth ISO (Connected/Broadcast Isochronous, i.e. LE Audio CIS/BIS) support, a Bluetooth controller/adapter path must be reachable by the process, and the attacker must have whatever local Bluetooth socket privileges the system enforces. Limiting factors that reduce realistic risk: no network vector (local access mandatory), no exploitation against hosts where Bluetooth ISO is not compiled in or not in use, and the need to reliably win a narrow concurrency window - none of which are present on a typical single-user or headless/server deployment without Bluetooth exposed to untrusted local users. |
| Impact | Signals point to a genuine but non-urgent kernel memory-safety bug rather than a mass-exploitation threat. The input CVSS is 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - critically, AV:L means this is NOT remotely reachable; an attacker must already have local code execution and the ability to open Bluetooth ISO sockets. EPSS is very low at 0.21% (10th percentile) and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation; this is 'no public exploit identified at time of analysis' (the only attached links are the kernel.org fix commits and an NVD/EUVD page, not PoC or exploit code). The vuln.today decision label is 'this_week', consistent with a patch-this-cycle local-privilege-escalation issue rather than an emergency. One conflict to flag: the input vector states AC:L, but the description explicitly describes a race between concurrent iso_sock_connect() calls both passing the admission check - a classic time-of-check/time-of-use window - which in practice reflects higher attack complexity (AC:H); treat the raw 7.8 as an upper bound on real-world ease. Net: a real priority for multi-user or untrusted-local-code Linux hosts with Bluetooth ISO (LE Audio) in use, but low priority for the vast majority of systems where the subsystem is absent or Bluetooth is not exposed to untrusted local users. |
| Exploit ScenarioDerived | A local unprivileged (but Bluetooth-capable) user process opens multiple AF_BLUETOOTH ISO sockets and issues concurrent connect calls, racing to replace a socket's destination or connection pointer during the window where iso_sock_connect() drops the socket lock. Winning the race strands a connection reference and conn->sk back-pointer so that a later teardown callback touches a freed socket (the KASAN slab-use-after-free in iso_sock_hold), enabling kernel memory corruption and potential local privilege escalation. No public exploit is identified; the race window (reflected as higher attack complexity) makes reliable exploitation non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
Use-after-free in the Linux kernel's Bluetooth ISO socket handling allows a local authenticated user (PR:L) to race concurrent iso_sock_connect() calls, replace the socket destination or connection state, and trigger a stale-connection callback after socket release. Affected systems are kernels built with Bluetooth ISO (LE Audio CIS/BIS) support and a reachable controller path; the assessed vector is AV:L/AC:H/PR:L because the attacker needs local code able to open AF_BLUETOOTH ISO sockets and must win a narrow concurrency window. No public exploit was identified at time of analysis, EPSS is 0.21% (10th percentile), and the vuln.today decision label is this_week rather than act_now.
RemediationAI
Vendor-released patch: update to Linux 6.6.160, 6.12.113, 6.18.57, 7.2.11 or 7.3, or apply the corresponding stable commits listed in the kernel.org references (9b6ed57eb8c892ee7566b8c1bd06fdd0053b53de, 1adcfe232c0f58890c2538211a841100ad0512bd, c6489a3a0ac8c07f64cb5b44f005bc518f1048ac, 3728f6b0d5990c0d500e929ba10baf93bee24f5e and e32d80293a0e1a160d5e5101daa8c82148c07510). No vendor-documented workaround is provided in the available sources; the complete fix is the kernel update. Exposure is limited to systems that compile Bluetooth ISO support and expose a reachable controller path to local users, so systems without those preconditions cannot be triggered, but that deployment property is not a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a time-of-check/time-of-use race in the Linux kernel's AF_BLUETOOTH ISO (isochronous) socket implementation used for LE Audio Connected Isochronous and Broadcast Isochronous streams. iso_sock_connect() validates socket state before taking the socket lock and releases the lock before route lookup and connection setup, so two connect callers can both pass admission; one can overwrite iso_pi(sk)->conn or replace the destination, stranding the first connection's reference and conn->sk back-pointer. Because teardown only detaches the current connection, a callback on the old connection (iso_conn_del/iso_connect_cfm/hci_conn_failed path) can race with iso_sock_release and dereference freed socket memory, as shown by the KASAN slab-use-after-free in iso_sock_hold. No CWE was supplied; the root cause is concurrent state mutation rather than a traditional parsing bug, and the supplied tag describes Information Disclosure while the assessed impact is C:H/I:H/A:H for the memory-safety fault. The independent assessment scores the issue AV:L/AC:H/PR:L, reflecting that local code must open ISO sockets, a Bluetooth controller path must be reachable, and the race must be won; kernels without Bluetooth ISO support are not affected.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:L because exploitation needs a local process opening ISO sockets; AC:H because the trigger is a race between concurrent connects; PR:L for an unprivileged local user; full C/I/A for kernel use-after-free.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: Serialize concurrent connect calls
iso_sock_connect() checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check while the socket is open or bound.
Caller A can copy its destination for route selection, then caller B can replace the socket destination before A binds or connects the CIS. A then uses B's destination with the route selected for its own request. B can also proceed after A attaches a connection and sets BT_CONNECT. For deferred BIS setup, B can bind a second BIS and overwrite iso_pi(sk)->conn, leaving the first connection's reference and conn->sk back-pointer stranded. Concurrent CIS connects can likewise replace the socket's connection. Later teardown only detaches the current connection, so a callback on the old connection can race with socket release and access a freed socket.
KASAN reported:
BUG: KASAN: slab-use-after-free in iso_sock_hold+0xf7/0x1b0 Call Trace: iso_sock_hold+0xf7/0x1b0 iso_conn_del+0x7b/0x1d0 iso_connect_cfm+0x186/0x16a0 hci_conn_failed+0x154/0x280 hci_abort_conn_sync+0x3dc/0x7d0 hci_cmd_sync_work+0x173/0x300
Allocated by task 121: sk_alloc+0x2b/0x6d0 bt_sock_alloc+0x29/0x370 iso_sock_alloc.constprop.0+0x19/0x300 iso_sock_create+0x94/0x100
Freed by task 121: kfree+0x121/0x3c0 __sk_destruct+0x42b/0x540 iso_sock_release+0x29d/0x340 __sock_release+0xa1/0x260
Check admission under the socket lock and mark the connect operation in progress before publishing its destination. Keep that flag set across route lookup and connection setup, rejecting another connect with -EBADFD before it can change the destination or attach a connection. Clear the flag after either helper returns, including on failure, so a failed setup can be retried.
A separate flag is needed because the socket lock must be released before acquiring the HCI device lock, while BT_CONNECT requires an attached connection. Keep the existing state transitions and the deferred CIS completion through iso_sock_recvmsg().
Reject an existing socket attachment in __iso_chan_add() before taking a new reference or publishing either pointer, so every caller preserves the connection association. Keep the same-socket, same-connection success case for deferred CIS setup. Reject an attached socket before BIS setup so a reusable BIS is not claimed before the attachment is rejected.
In CIS setup, reject a different HCI connection before iso_conn_add() and drop the per-attempt HCI hold directly. An unowned iso_conn may still carry another reference after detachment, so its destruction cannot be relied on to release that hold.
iso_listen_bis() creates a fresh PA HCI/ISO pair under the device lock, so the temporary iso_conn_put() frees the ISO candidate and drops its HCI hold on rejection. iso_conn_ready() uses a freshly allocated, unpublished child with no connection, making the socket-side rejection unreachable.
Executive ViewAI
CVE-2026-99012 is a high-severity use-after-free vulnerability in the Linux kernel's Bluetooth ISO socket handling, affecting systems with LE Audio support. A local authenticated user could exploit a race condition to trigger a stale-connection callback, potentially leading to system instability or privilege escalation. While no public exploit exists and EPSS is low (0.21%), leadership should prioritize patching to prevent potential disruptions in environments using Bluetooth audio, especially with kernel versions lacking fixes.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB