In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup iso_sock_listen() drops the… (CVE-2026-99013)

The vulnerability in the Linux kernel Bluetooth ISO implementation arises from iso_sock_listen() dropping the socket lock before calling iso_listen_bis(), allowing two concurrent listen() calls on the same broadcast socket to both observe BT_BOUND. This leads to a race condition where the second connection attachment overwrites the first connection reference, leaking the first connection and leaving its socket intact. Subsequent socket teardown of the second connection can cause stale socket access on the first connection, resulting in a use-after-free condition. The fix involves rechecking BT_BOUND and ensuring iso_pi(sk)->conn is NULL after acquiring both HCI device and socket locks, rejecting competing setups with an error code before allocating another connection. A KASAN report confirmed the use-after-free in iso_sock_hold during socket teardown.

The vulnerability can cause use-after-free memory corruption in the Bluetooth ISO subsystem of the Linux kernel. This may lead to kernel crashes or undefined behavior when stale socket references are accessed. There is no indication of remote code execution or privilege escalation in the provided data. Exploitation requires concurrent BIS listener setups on the same broadcast socket.

A fix has been implemented in the Linux kernel to address this issue by adding proper locking and connection checks to prevent concurrent BIS listener setups from causing stale socket accesses. Users should update to the fixed kernel version once available. No alternative mitigations or workarounds are specified.