The Linux kernel Bluetooth ISO subsystem contained a use-after-free vulnerability (CVE-2026-80914) in the iso_conn_ready() function. The function obtains a reference to a BIS listener socket with iso_get_sock(), then locks it and creates a child socket. If the listener socket is closed concurrently between obtaining the reference and locking it, the reference may be the last one, causing the socket to be freed. The child socket remains linked to the freed parent socket, and subsequent operations dereference this dangling pointer, causing use-after-free. The fix involves re-checking the listener socket's state after locking it to ensure it is still alive and listening, aborting if not.

Successful exploitation can lead to use-after-free memory corruption in the Bluetooth ISO subsystem, potentially allowing an attacker to execute arbitrary code, cause denial of service, or compromise system confidentiality, integrity, and availability. The CVSS v3.1 score is 8.8 (high severity), reflecting network attack vector with low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include the patch for CVE-2026-80914. Since this is a kernel-level vulnerability, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly stated in the provided data; therefore, check the vendor or Linux kernel advisory for the exact fixed versions and update guidance.