PT-2026-52371 · Linux · Linux
Published
2026-06-25
·
Updated
2026-06-25
·
CVE-2026-53276
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: Fix a use-after-free of the hci conn pointer
In iso sock rebind bc(), the bis pointer is cached, then the socket lock is
dropped:
bis = iso pi(sk)->conn->hcon;
/* Release the socket before lookups since that requires hci dev lock
* which shall not be acquired while holding sock lock for proper
* ordering.
*/
release sock(sk);
hci dev lock(bis->hdev);
During the unlocked window, could a concurrent close() destroy the connection
and free the bis structure, causing hci dev lock(bis->hdev) to access memory
after it is freed, fix this by using the hdev reference which was safely
acquired via iso conn get hdev().
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux