Linux Kernel EUVD-2026-59726

The attacker must be within Bluetooth radio range of the target system (AV:A - not exploitable remotely over IP). The target kernel must be in the affected version range (6.11.11 through pre-6.12, or 6.12.2 through pre-6.13) with Bluetooth ISO channel support compiled in and active. Exploitation requires winning a concurrent timing race between the iso_recv workqueue path and an iso_conn_put teardown - inherently probabilistic and dependent on kernel scheduling. Per the CVSS PR:N vector, no local privileges or authentication are required from the attacker; the attack is driven entirely from the Bluetooth medium. Exploitation is constrained by: (1) physical proximity enforced by Bluetooth radio range, (2) the probabilistic nature of the race condition requiring repeated attempts, (3) the Bluetooth ISO feature needing to be in active use on the target, and (4) the absence of any confirmed public exploit code that would lower the skill threshold.

The supplied CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H produces a score of 8.8, but the AC:L designation is analytically inconsistent with the race condition nature of this flaw. Reliably winning a timing race between hdev->workqueue and a concurrent teardown path is inherently sensitive to scheduling jitter and system load, which maps more accurately to AC:H - reducing the practical exploitability well below the raw score implies. EPSS at 0.15% (5th percentile) independently corroborates low real-world exploitation probability. There is no CISA KEV listing and no confirmed proof-of-concept code. The primary real-world risk is a skilled attacker within Bluetooth radio range who can repeatedly induce ISO connection churn to win the race window, potentially achieving kernel code execution or denial of service. For most hardened enterprise environments where Bluetooth is disabled or unused, exposure is negligible despite the high CVSS headline. This is a patch-on-cycle rather than emergency-remediation vulnerability absent active exploitation evidence.

An attacker positions themselves within Bluetooth radio range of a target Linux system running an affected kernel with Bluetooth ISO channels active. By repeatedly initiating and tearing down Bluetooth ISO connections, the attacker drives high-frequency concurrent execution of the iso_recv and iso_conn_put paths in the kernel. If the race window is won - iso_conn_free() completing kfree() before iso_conn_hold_unless_zero() increments the reference count - the attacker achieves a use-after-free in kernel memory, which can be leveraged for kernel heap manipulation, privilege escalation, or a kernel panic causing denial of service. No public proof-of-concept exploit exists, and reproducing the race reliably requires precise scheduling manipulation.