Linux Kernel CVE-2026-99013

Requires local access as a user able to create Bluetooth ISO broadcast sockets (PR:L, AV:L); no user interaction. The concrete prerequisite is issuing two concurrent listen() calls on the same broadcast ISO socket so both observe BT_BOUND, racing the interval in iso_sock_listen() where the socket lock is dropped before iso_listen_bis() and before BT_LISTEN is published. Limiting factors: the kernel must be built with and the device must support Bluetooth ISO broadcast (BIS); the affected version range (fixed in commits landing in e.g. stable 6.12.113 and sibling branches) must be running; and the attacker must win a narrow timing window, so reliability is low. There is no network vector and no remote reachability.

Signals are consistent and point to a genuine but non-emergency local kernel flaw. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N) reflects high confidentiality, integrity and availability impact, but every signal tempering urgency agrees: EPSS is 0.21% (11th percentile), the CVE is NOT in CISA KEV, and no exploit or PoC reference is present - only upstream kernel fix commits. The vuln.today decision label is 'this_week' rather than act_now/emergency, which is proportionate to a local-only use-after-free. Note a tension worth flagging: the CVSS vector encodes AC:L, yet the description explicitly describes the trigger as a race between two concurrent listen() calls (caller A observes BT_BOUND and attaches connA, caller B attaches connB before A publishes BT_LISTEN), which is a timing-dependent condition more naturally scored AC:H - this is why my independent assessment lowers attack complexity confidence. The attacker must already be local and able to open Bluetooth ISO sockets (PR:L), so this is a local privilege-escalation / memory-corruption primitive, not a remotely reachable issue. Real priority: patch on a normal stable-update cadence; it is a legitimate kernel UAF but not under active exploitation and not trivially weaponizable.

A local unprivileged user with access to the Bluetooth stack opens a broadcast ISO (BIS) socket and issues two concurrent listen() calls on it, racing the window where iso_sock_listen() drops the socket lock. Winning the race overwrites iso_pi(sk)->conn so the connA reference is leaked while connA->sk remains valid; a later HCI disconnect-complete event then dereferences the freed socket (the KASAN report shows slab-use-after-free in iso_sock_hold via iso_conn_del), yielding kernel memory corruption usable for privilege escalation or denial of service. No public exploit or PoC code is identified in the provided data - only the upstream fix commits.