CVE-2026-80914 Overview
CVE-2026-80914 is a use-after-free vulnerability in the Linux kernel's Bluetooth ISO (Isochronous) subsystem. The flaw resides in the iso_conn_ready() function, which handles Broadcast Isochronous Stream (BIS) listener sockets. When a listener socket closes concurrently with connection establishment, the parent socket reference can be freed while a child socket still holds a dangling pointer to it. A later disconnect triggers iso_chan_del() and bt_accept_unlink(), which dereference the freed parent socket. Exploitation requires Bluetooth radio proximity to the target system.
Critical Impact
An adjacent-network attacker within Bluetooth range can trigger memory corruption in the Linux kernel, potentially leading to privilege escalation, code execution, or denial of service.
Affected Products
- Linux kernel Bluetooth ISO subsystem (BIS listener socket handling)
- Kernel branches prior to commits 03288b7447c9, 2387cd06a2c0, 49fd7116f76b, and 560bef609fa5
- Distributions shipping vulnerable stable kernel versions with Bluetooth LE Audio support
Discovery Timeline
- 2026-09-09 - CVE-2026-80914 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-80914
Vulnerability Analysis
The vulnerability affects the Bluetooth ISO code path introduced to support LE Audio Broadcast Isochronous Streams. When an incoming BIS connection is signaled, iso_conn_ready() calls iso_get_sock() to locate the parent listener socket. That helper takes a reference on the socket and returns it. The function then acquires lock_sock(parent), allocates a child socket via iso_sock_alloc(), and links it to the parent through iso_chan_add().
Between the iso_get_sock() call and lock_sock(), another thread can close the listener socket. The close path drops the link-list reference, leaving iso_conn_ready() holding the last remaining reference. Once iso_conn_ready() finishes and drops that reference at function exit, the parent socket is freed. The child socket, however, remains linked to the freed parent structure. A subsequent disconnect of the child invokes iso_chan_del() and bt_accept_unlink(), which dereference the dangling parent pointer into a freed accept queue.
Root Cause
The root cause is a missing state re-check after acquiring the socket lock. The parent socket's state is not validated between reference acquisition and child linkage. This is the same class of defect previously fixed in the connected (non-BIS) code path by commit 0d255e63fcf3 ("Bluetooth: ISO: hold sk properly in iso_conn_ready"). The BIS branch was not updated at that time, leaving a parallel use-after-free window [CWE-416].
Attack Vector
Exploitation requires an attacker within Bluetooth radio range of a target system with BIS listening enabled. The attacker must race an incoming ISO connection request against a legitimate close of the listener socket. Successful triggering results in kernel heap use-after-free, which skilled attackers can shape into arbitrary read/write primitives or control flow hijacking. No user interaction or authentication is required.
No public proof-of-concept exploit is currently available. Refer to the upstream kernel commits for the precise call sequence and fix details.
Detection Methods for CVE-2026-80914
Indicators of Compromise
- Kernel oops or panic messages referencing iso_chan_del, bt_accept_unlink, or iso_conn_ready in dmesg and /var/log/kern.log
- KASAN reports indicating use-after-free in the Bluetooth ISO subsystem
- Unexpected Bluetooth stack crashes or bluetoothd restarts on hosts advertising or accepting BIS connections
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) on test kernels to surface use-after-free conditions in net/bluetooth/iso.c during fuzzing.
- Monitor kernel ring buffer output for slab-use-after-free warnings tagged to Bluetooth socket structures.
- Correlate Bluetooth device pairing and disconnection events with kernel crash dumps to identify race-condition triggers.
Monitoring Recommendations
- Deploy endpoint telemetry that captures kernel crash reports and forwards them to a centralized log store for correlation.
- Track kernel version inventory across Linux fleets to identify hosts running vulnerable builds.
- Alert on repeated Bluetooth subsystem restarts, which may indicate exploitation attempts against the ISO code path.
How to Mitigate CVE-2026-80914
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree commits: 03288b7447c9, 2387cd06a2c0, 49fd7116f76b, and 560bef609fa5.
- Update to a distribution kernel package that incorporates the fix once released by your vendor.
- Disable Bluetooth on systems that do not require it, particularly servers and infrastructure hosts.
Patch Information
The fix mirrors the approach used in commit 0d255e63fcf3 for the connected code path. After lock_sock(parent) completes, the patched code re-checks that the parent socket is still in listening state and remains alive. If either check fails, iso_conn_ready() releases the lock, drops the reference, and returns without linking a child socket to the freed parent.
Workarounds
- Unload the Bluetooth kernel module (modprobe -r bluetooth) on systems where Bluetooth is not required.
- Disable LE Audio and BIS support in the Bluetooth stack configuration where available.
- Restrict physical access and Bluetooth radio range around vulnerable systems until patches are applied.
# Verify running kernel and disable Bluetooth if not needed
uname -r
systemctl stop bluetooth.service
systemctl disable bluetooth.service
modprobe -r btusb bluetooth
# Blacklist Bluetooth modules persistently
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb' | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
