Linux Kernel EUVD-2026-59731

The target system must have Bluetooth enabled and an active socket in the ISO LISTEN or CONNECT state, meaning it must be running Bluetooth LE Audio or another application that uses the Bluetooth ISO profile - this is not a default configuration on general-purpose servers or workstations. The attacker must be within Bluetooth radio range of the target device. Successful exploitation further requires winning a race condition between the ev3 event handler and a concurrent socket state transition, which introduces inherent timing dependency. Systems without Bluetooth hardware, with Bluetooth disabled via rfkill, or not running any Bluetooth ISO-dependent applications are not reachable. The authenticated versus unauthenticated boundary: the CVSS vector PR:N confirms no Bluetooth-layer authentication is required to send connection indication events, but the target must be in an actively listening or connecting ISO state.

The vendor-assigned CVSS 8.8 (AV:A/AC:L/PR:N/UI:N) captures a significant adjacent-network exposure reachable without authentication, consistent with Bluetooth's radio proximity constraint. However, the EPSS exploitation probability of 0.17% at the 6th percentile, combined with the absence of a CISA KEV listing, indicates the security community has not yet developed or observed weaponized exploits. The race condition nature of the flaw introduces practical exploitation complexity - reliable triggering requires precise timing between the ev3 handler and a concurrent socket state transition - which arguably warrants AC:H over the vendor's AC:L rating. Even a mid-sized municipal IT team in legnica managing Linux-based Bluetooth-enabled edge gateways or IoT audio infrastructure should treat this as a priority patch, since a successful race could produce a kernel panic or kernel memory corruption with potential for privilege escalation. Real-world risk is significantly narrowed by the requirement that the target system have an active Bluetooth ISO socket, which is not the default state for most general-purpose servers. No public PoC has been identified at time of analysis.

An attacker within Bluetooth radio range (typically 10 to 100 meters depending on device class) sends crafted Bluetooth LE ISO connection indication events to a target system running a vulnerable kernel with an active Bluetooth ISO socket. During processing of the ev3 event, the kernel accesses iso_pi(sk)->conn without holding the socket lock; if a concurrent thread simultaneously transitions the socket away from LISTEN or CONNECT state, the resulting NULL or stale pointer dereference causes a kernel panic or memory corruption. No public proof-of-concept code has been identified, and reliable exploitation requires winning a precise timing race.