CVE-2026-80721

This flaw is a dangling-pointer condition in the Linux kernel's Bluetooth ISO (isochronous, LE Audio) socket layer: when a Bluetooth ISO connection is torn down, iso_conn_del() did not explicitly clear the iso_conn's hcon pointer, so an ISO socket racing against connection teardown could still dereference the HCI connection object (hcon) after it had been freed. It is triggered when ISO link teardown races with concurrent socket-side operations, i.e., an attacker in Bluetooth radio range who can cause or observe ISO connection disconnects at the right moment, with no authentication or user interaction required. Successful exploitation of this class of bug can lead to kernel memory corruption, with the CVSS v3.1 score of 8.8 (high) indicating potential for high-impact information disclosure, integrity compromise, or denial of service. Any Linux system running a kernel that includes the Bluetooth ISO socket code with Bluetooth enabled is potentially affected; the data does not specify exact affected version ranges or fixed releases. There is no known public proof-of-concept, it is not in the CISA KEV catalog, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Update affected systems to kernel releases that include the upstream fix for this Bluetooth ISO issue (the commit explicitly clearing conn->hcon in iso_conn_del()); check your vendor's security advisories for backported stable kernels, as exact fixed versions are not stated in the available data. As an interim mitigation, disable Bluetooth or avoid ISO/LE Audio (e.g., LE Audio headset/auracast) connections on systems running affected kernels, and verify whether the Bluetooth ISO feature (CONFIG_BT_ISO) is enabled in deployed kernels.