Linux Kernel EUVD-2026-75088

Exploitation requires all of the following: (1) the attacker must be within Bluetooth radio range of the target (typically ≤10m, AV:A); (2) the target must be running a Linux kernel with Bluetooth ISO/BIS support compiled in (CONFIG_BT_LE_ISO) and must have an active BIS listener socket open - meaning an application is explicitly listening for Broadcast Isochronous Stream connections; (3) the race condition requires the listener socket to be concurrently closed during the exploitation window, such as during application shutdown or socket lifecycle transitions. Systems without Bluetooth hardware, without BLE Audio kernel support, or without any application holding an active BIS listener socket are not exploitable. The race window is narrow and may require repeated attempts, making reliable exploitation non-trivial in the absence of additional heap-shaping primitives or kernel version-specific gadgets.

The provided CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.8) reflects a high-severity, adjacent-network, unauthenticated attack with full CIA impact. The adjacent-only attack vector (Bluetooth range, typically ≤10m) meaningfully constrains the threat surface compared to network-exploitable flaws - exploitation requires physical proximity, ruling out most remote internet-based attackers. The AC:L rating may understate practical difficulty: successfully exploiting a kernel race condition requires reliable timing control, and without a known proof-of-concept, the actual exploitation bar remains uncertain. No EPSS score was provided, KEV listing is absent, and no public exploit has been observed, suggesting the vulnerability is theoretical at this stage. That said, kernel use-after-free vulnerabilities in Bluetooth stacks have historically been weaponized once heap-layout techniques are applied, and even a mid-sized municipal IT team in walbrzych managing Linux audio gateways or LE Audio-capable workstations should treat this as an urgent patching priority given the kernel-level impact if triggered. Risk is highest in environments with active BIS listener applications - embedded LE Audio receiver hardware, conference room audio systems, or IoT gateways - and lowest on headless servers without Bluetooth hardware or kernel Bluetooth ISO support.

An attacker within Bluetooth range of a Linux system running a BIS listener repeatedly sends Broadcast Isochronous Stream synchronization requests to trigger repeated invocations of iso_conn_ready() in the kernel. By timing requests to coincide with application-layer socket teardown (such as a service restart or graceful shutdown of a Bluetooth LE Audio receiver), the attacker wins the TOCTOU race and causes a child socket to be created with a dangling pointer to the freed parent. When the child socket is later disconnected - which may occur naturally or be forced by sending a disconnect event - the kernel dereferences the freed parent in iso_chan_del(), enabling heap manipulation and potential arbitrary kernel code execution. No public proof-of-concept exploit has been identified at time of analysis.