In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent connect calls iso_sock_connect() checks the… (CVE-2026-99012)

The vulnerability in the Linux kernel Bluetooth ISO layer involved iso_sock_connect() not properly serializing concurrent connect calls. The function checked socket state before locking and released the lock before connection setup, allowing two callers to pass admission checks simultaneously. This could cause one caller to overwrite the socket destination or connection references of another, leading to use-after-free bugs as callbacks could access freed sockets. The fix involves checking admission under the socket lock, marking the connect operation as in progress to reject concurrent connects, and ensuring proper reference management during connection setup and teardown.

The vulnerability could lead to use-after-free conditions in the Bluetooth ISO socket connection handling, potentially causing kernel crashes or memory corruption. However, no known exploits in the wild have been reported. The impact is limited to systems using the affected Linux kernel Bluetooth ISO socket code.

A fix has been implemented in the Linux kernel to serialize concurrent connect calls in iso_sock_connect(), preventing race conditions and use-after-free issues. Users should apply the official kernel updates containing this fix. No additional mitigation is required beyond applying the patch.