222 lines
13 KiB
JSON
222 lines
13 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-80914",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-08-26T14:34:25.801Z",
|
|
"datePublished": "2026-09-09T16:10:58.675Z",
|
|
"dateUpdated": "2026-10-19T08:44:59.509Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-19T08:44:59.509Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready\n\niso_conn_ready() looks up the BIS listener socket with iso_get_sock(),\nwhich takes a reference, and then, without re-checking its state,\ncreates a child socket from it:\n\n parent = iso_get_sock(hdev, ...);\n if (!parent)\n return;\n\n lock_sock(parent);\n sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...);\n ...\n iso_chan_add(conn, sk, parent);\n ...\n release_sock(parent);\n sock_put(parent);\n\nIf the listener socket is closed concurrently, between iso_get_sock()\nand lock_sock(), the reference taken by iso_get_sock() may be the last\none: the close path drops the link-list reference, and once\niso_conn_ready() drops its own reference at the end of the function the\nsocket is freed. The child socket, however, is already linked to the\nfreed parent, and a later disconnect of the child runs iso_chan_del()\n-> bt_accept_unlink(), which dereferences the dangling parent pointer\ninto the freed accept queue (a use-after-free). The same dangling\npointer is also dereferenced through parent->***() in\niso_chan_del().\n\nFix it the same way the connected (non-BIS) path was fixed in commit\n0d255e63fcf3 (\"Bluetooth: ISO: hold sk properly in iso_conn_ready\"):\nafter taking the socket lock, re-check that the parent is still a\nlistening, alive socket, and bail out otherwise."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 8.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:A - The UAF is in Bluetooth ISO iso_conn_ready() parent-lookup for incoming CIS/BIS/PA; that path runs from HCI connect_cfm events (hci_le_cis_req_evt, BIG/PA sync) driven by LE isochronous traffic from peers in radio range, which is an adjacent attack surface.\nAC:L - This is a use-after-free race between iso_get_sock() and listener close (iso_sock_release/iso_sock_kill) before lock_sock(); an attacker who opens/closes an ISO listen socket while concurrent HCI CIS/BIS/PA completion runs controls both sides and can trigger it without uncontrollable conditions.\nPR:N - iso_sock_create has no capability check, and the vulnerable path is reached from unauthenticated HCI CIS/BIG/PA events processed for any Bluetooth-enabled device in range; listener close can occur from automatic LE Audio/bluetoothd teardown without privileged local credentials.\nUI:N - No victim action is required: iso_connect_ind returns HCI_LM_ACCEPT so incoming CIS/BIS/PA sync is auto-accepted when an ISO listener exists, and OS LE Audio stacks keep such listeners during normal broadcast/unicast operation.\nS:U - The UAF corrupts kernel socket/accept-queue memory and can enable privilege escalation within the host kernel; it does not cross a VM, container, or IOMMU security boundary, so scope remains unchanged.\nC:H - Use-after-free of the listener struct sock (and later bt_accept_unlink of the dangling parent) lets an attacker reuse the freed sock/accept-queue object, enabling arbitrary kernel memory disclosure via heap grooming per UAF guidance.\nI:H - The child is linked to the freed parent via iso_chan_add/bt_accept_enqueue; later iso_chan_del -> bt_accept_unlink writes the freed parent's accept queue (list_del, sk_acceptq_removed), a kernel heap write primitive usable for control-flow hijack.\nA:H - Dereferencing the freed listener in iso_chan_del/bt_accept_unlink (accept_q_lock, list, parent->sk_data_ready) causes kernel oops/panic; UAFs in this ISO path are a high availability impact even before full exploitation."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/bluetooth/iso.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
|
|
"lessThan": "1702f12cf59a1c3b670eb6bb4a4d6fcccf07e3b8",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
|
|
"lessThan": "d47b8f8c02a3d3f282693e5a4ff1f6b4b00518de",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
|
|
"lessThan": "2387cd06a2c0b416f05028b02bba1089f54c28d9",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
|
|
"lessThan": "49fd7116f76b860b230843700fb7423ab5331e1f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
|
|
"lessThan": "03288b7447c9e572f8ab82fc29cfb4ca719ab210",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
|
|
"lessThan": "560bef609fa5992745929e8d7d458b9d88dd2830",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/bluetooth/iso.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.0",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.0",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.188",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.157",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.109",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.50",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.4",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.0",
|
|
"versionEndExcluding": "6.1.188"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.0",
|
|
"versionEndExcluding": "6.6.157"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.0",
|
|
"versionEndExcluding": "6.12.109"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.0",
|
|
"versionEndExcluding": "6.18.50"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.0",
|
|
"versionEndExcluding": "7.2.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.0",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1702f12cf59a1c3b670eb6bb4a4d6fcccf07e3b8"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d47b8f8c02a3d3f282693e5a4ff1f6b4b00518de"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/2387cd06a2c0b416f05028b02bba1089f54c28d9"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/49fd7116f76b860b230843700fb7423ab5331e1f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/03288b7447c9e572f8ab82fc29cfb4ca719ab210"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/560bef609fa5992745929e8d7d458b9d88dd2830"
|
|
}
|
|
],
|
|
"title": "Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |