CVE-2026-80914

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Bluetooth ISO implementation. The iso conn ready() function retrieves a BIS listener socket using iso get sock() and creates a child socket without verifying the parent socket's current state. If the listener socket is closed concurrently between the calls to iso get sock() and lock sock(), the parent socket may be freed while the child socket remains linked to it. Subsequent disconnection of the child socket triggers iso chan del() and bt accept unlink(), which dereference the dangling pointer to the freed parent socket.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.