CVE-2026-80914: Use-after-free in Linux Kernel Bluetooth ISO

CVE-2026-80914 is a use-after-free vulnerability in the Linux kernel Bluetooth ISO subsystem. The flaw resides in the iso_conn_ready() function, where a listener socket can be deallocated while still referenced by a newly created child socket, causing access to already-freed memory. A race condition between socket lookup and lock acquisition allows another thread to close the listener socket between the two events.

The CVSS score is 8.8, HIGH severity. The vulnerability was fixed in the main kernel codebase (commit 0d255e63fcf3). Published 2026-09-09 on NVD, today 2026-11-06 we report GitHub repositories claiming POC availability. Although content is unverified, their appearance indicates increased public interest in the flaw and requires immediate defensive action.

Administrators must verify the kernel version in use and apply the update released after the fix. It is critical to verify if Bluetooth ISO is enabled on critical systems: where not needed, disabling it provides additional mitigation. Continuously monitor kernel logs for crashes, oops messages, or stability anomalies on systems with Bluetooth ISO enabled.

The vulnerability stems from the socket reference counting mechanism. Between the moment iso_get_sock() increments the counter and lock_sock() acquires the lock, another thread can close the listener. The function does not re-check the socket state after locking, leaving the child socket linked to a deallocated parent, causing illegal dereference at disconnect time.