CVE-2026-80721: Linux Kernel Bluetooth ISO Race Condition

CVE-2026-80721 Overview

CVE-2026-80721 is a use-after-free vulnerability in the Linux kernel's Bluetooth Isochronous Channels (ISO) subsystem. The flaw allows ISO sockets to dereference a stale hcon (HCI connection) pointer after iso_conn_del() releases the connection. The previous logic relied on iso_conn_del() dropping the final reference to iso_conn to clear the pointer, which created race conditions when other code paths held references. An adjacent-network attacker within Bluetooth range can exploit the resulting dangling pointer to corrupt kernel memory or execute code in kernel context.

Critical Impact
Successful exploitation can lead to kernel memory corruption, denial of service, or arbitrary code execution in kernel space from an adjacent Bluetooth attacker.

Affected Products

Linux kernel versions containing the Bluetooth ISO subsystem prior to the fix commits
Distributions shipping vulnerable stable kernel branches (see upstream stable trees)
Devices with Bluetooth LE Audio / Isochronous Channels enabled

Discovery Timeline

2026-08-28 - CVE-2026-80721 published to NVD
2026-08-30 - Last updated in NVD database

Technical Details for CVE-2026-80721

Vulnerability Analysis

The vulnerability resides in the Linux kernel Bluetooth ISO socket implementation. The iso_conn structure holds a pointer to an hcon object representing the underlying HCI connection. When iso_conn_del() executes, it tears down the ISO connection, but clearing iso_conn::hcon depended on releasing the last reference to iso_conn itself.

When other code paths still hold references to iso_conn, ISO sockets can continue to dereference conn->hcon after the HCI connection has been freed. This yields a classic use-after-free condition against kernel memory. The upstream fix explicitly clears conn->hcon inside iso_conn_del(), removing the reliance on reference-count ordering.

The vulnerability requires an adjacent-network position, meaning the attacker must be within Bluetooth radio range of the target. No user interaction or prior privileges are needed on the target system, and successful exploitation impacts confidentiality, integrity, and availability of the kernel.

Root Cause

The root cause is unsafe reference lifecycle management between iso_conn and its embedded hcon pointer. The original code assumed that clearing hcon would coincide with the final iso_conn release, but concurrent socket operations could dereference a stale pointer between the HCI connection teardown and the final iso_conn free. This is a use-after-free defect in the Bluetooth ISO subsystem.

Attack Vector

Exploitation requires the attacker to be within Bluetooth range of a target with ISO channels active, typically hosts using LE Audio or CIS/BIS streams. An attacker can trigger repeated connection setup and teardown sequences to race ISO socket operations against iso_conn_del(). Winning the race causes the kernel to dereference freed memory, which a well-crafted heap grooming primitive can escalate into memory corruption. Technical details are available in the upstream commits: Kernel Git Commit AA9F7CB, Kernel Git Commit CDCE8AF, and Kernel Git Commit E941799.

Detection Methods for CVE-2026-80721

Indicators of Compromise

Kernel oops or panic messages referencing iso_sock_*, iso_conn_del, or hci_conn functions in dmesg or journalctl.
KASAN reports flagging use-after-free reads or writes inside the Bluetooth ISO subsystem.
Unexpected Bluetooth stack restarts or bluetoothd crashes following anomalous LE Audio pairing attempts.

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface use-after-free access patterns in net/bluetooth/iso.c.
Monitor kernel ring buffers for repeated Bluetooth subsystem faults correlated with nearby untrusted devices.
Audit installed kernel versions against fixed commits on managed endpoints to identify unpatched hosts.

Monitoring Recommendations

Collect and centralize kernel crash telemetry from Linux endpoints for triage against known Bluetooth CVE signatures.
Track Bluetooth adapter activity in physical-access environments where LE Audio devices are used.
Alert on repeated hci0 link resets or ISO channel teardown storms that may indicate exploitation attempts.

How to Mitigate CVE-2026-80721

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits aa9f7cb, cdce8af, and e941799 or upgrade to a distribution kernel that includes these fixes.
Disable Bluetooth on systems that do not require it, particularly servers, workstations, and IoT devices without a business need for wireless audio.
Restrict Bluetooth discoverability and pairing on hosts that must keep the stack enabled.

Patch Information

The fix is upstream in three stable-tree commits. Each commit modifies iso_conn_del() to explicitly clear conn->hcon before releasing the connection, eliminating the dangling reference. Reference the exact patches at Kernel Git Commit AA9F7CB, Kernel Git Commit CDCE8AF, and Kernel Git Commit E941799. Deploy vendor-provided kernel updates through standard patch management channels.

Workarounds

Unload the Bluetooth kernel modules on hosts that do not require wireless connectivity using modprobe -r bluetooth.
Blacklist Bluetooth modules by adding blacklist bluetooth and blacklist btusb to /etc/modprobe.d/ on affected systems.
Physically remove or disable Bluetooth radios via BIOS/UEFI where policy allows, reducing the adjacent-network attack surface.

bash

# Configuration example: disable Bluetooth stack until kernel is patched
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb' | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo modprobe -r btusb bluetooth