{"id":"CVE-2026-99013","kind":"vulnerability","aliases":["CVE-2026-99013"],"related":[],"title":"Linux kernel: concurrent Bluetooth BIS listen calls cause use-after-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Reject concurrent BIS listener setup\n\niso_sock_listen() drops the socket lock before calling iso_listen_bis()\nto preserve the hdev->lock ordering. Two concurrent listen() calls on\nthe same broadcast socket can therefore both observe BT_BOUND. Caller\nA can attach connA and release the locks, then caller B can acquire\nthem and attach connB before A publishes BT_LISTEN.\n\n__iso_chan_add() checks whether connB already has a socket, but not\nwhether the socket already has a connection. The second attachment\noverwrites iso_pi(sk)->conn, leaking the connA reference and leaving\nconnA->sk intact. Socket teardown follows connB, so later events on\nconnA can cause a stale socket access.\n\nRecheck BT_BOUND and require iso_pi(sk)->conn to be NULL after taking\nboth the HCI device and socket locks in iso_listen_bis(). The connection\ncheck also covers the interval between attachment and publication of\nBT_LISTEN. Reject a competing setup with -EBADFD through the existing\nunlock path before allocating another connection.\n\nA recorded KASAN report from an instrumented kernel shows:\n\n  BUG: KASAN: slab-use-after-free in iso_sock_hold+0x119/0x1f0\n  Call Trace:\n   iso_sock_hold+0x119/0x1f0\n   iso_conn_del+0xe4/0x270\n   hci_disconn_complete_evt+0x351/0x8c0\n   hci_event_packet+0x71b/0xb20\n   hci_rx_work+0x293/0x730\n\n  Allocated by task 93:\n   sk_prot_alloc+0x113/0x220\n   sk_alloc+0x2b/0x6d0\n   bt_sock_alloc+0x29/0x370\n   iso_sock_alloc.constprop.0+0x19/0x300\n   iso_sock_create+0x94/0x100\n\n  Freed by task 93:\n   kfree+0x121/0x3c0\n   __sk_destruct+0x42b/0x540\n   iso_sock_release+0x29d/0x340\n   __sock_release+0xa1/0x260\n   sock_close+0x10/0x20","summary":"Two simultaneous listen() calls on the same Bluetooth ISO broadcast socket can attach two connections, leaving one connection pointing at a socket that is later freed. The sources show a KASAN slab-use-after-free in the Bluetooth ISO connection teardown path, which can crash the kernel or corrupt memory.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","kernel","linux","runtime","self-hosted"],"not_affected_if":["bluetooth-disabled","no-bluetooth-hardware"],"how_to_check":"- `uname -r` and compare against the kernel version that carries the upstream fix, which the sources do not name\n- `lsmod | grep -i bluetooth` to see whether the Bluetooth stack with ISO support is loaded on the host\n- unknown whether the sources list a specific config option to test for","fix":"- Install the kernel update from your distribution that includes the upstream commit 'Bluetooth: ISO: Reject concurrent BIS listener setup' (version unknown from sources)\n- Reboot into the patched kernel after updating\n- Until patched, unknown whether unloading the Bluetooth ISO modules is a viable mitigation","status":"open","published_at":"2026-10-23T13:17:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:55:47+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:55:47Z","model":"claude-haiku-5-5","output":{"fix":"- Install the kernel update from your distribution that includes the upstream commit 'Bluetooth: ISO: Reject concurrent BIS listener setup' (version unknown from sources)\n- Reboot into the patched kernel after updating\n- Until patched, unknown whether unloading the Bluetooth ISO modules is a viable mitigation","reach":"local","title":"Linux kernel: concurrent Bluetooth BIS listen calls cause use-after-free","impact":"high","summary":"Two simultaneous listen() calls on the same Bluetooth ISO broadcast socket can attach two connections, leaving one connection pointing at a socket that is later freed. The sources show a KASAN slab-use-after-free in the Bluetooth ISO connection teardown path, which can crash the kernel or corrupt memory.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","bluetooth","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"local code can corrupt kernel memory, crashing or taking over the host","analyst_note":"Find the fixed kernel versions and stable backport commit IDs for this Bluetooth ISO fix in the kernel git log or the NVD entry for CVE-2026-99013.","how_to_check":"- `uname -r` and compare against the kernel version that carries the upstream fix, which the sources do not name\n- `lsmod | grep -i bluetooth` to see whether the Bluetooth stack with ISO support is loaded on the host\n- unknown whether the sources list a specific config option to test for","needs_analyst":true,"not_affected_if":["no-bluetooth-hardware","bluetooth-disabled"],"who_is_affected":"Systems running a Linux kernel with Bluetooth ISO (LE Audio broadcast) support that use broadcast sockets, where a local process can call listen() concurrently. Hosts without Bluetooth hardware or with the Bluetooth stack disabled are unlikely to be exposed. The sources do not say which distributions or kernel versions are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000771,"input_tokens":3985,"output_tokens":745,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':275C,282C,287C,293C,298C,303C,312C,316C,321C,325C,330C,337C,341C,346C,350C,354C '-2026':14A,17A '-99013':15A,18A '0':324C '93':308C,335C 'access':200C 'acquir':140C 'add':152C 'alloc':252C,305C,311C,315C,320C 'alreadi':156C,165C 'also':229C 'anoth':253C 'attach':38B,130C,143C,171C,234C 'b':138C 'bis':5A,91C,105C,225C 'bluetooth':4A,19B,33B,64B,87C 'bound':126C,203C 'broadcast':35B,119C 'bt':125C,148C,202C,238C,318C 'bug':264C 'call':7A,29B,102C,115C,277C 'caller':127C,137C 'caus':8A,196C 'chan':151C 'check':153C,228C 'close':353C 'compet':242C 'complet':291C 'concurr':3A,90C,113C 'conn':176C,209C,285C 'conna':131C,179C,183C,194C 'connb':144C,155C,189C 'connect':40B,43B,66B,168C,227C,254C 'corrupt':75B 'cover':230C 'crash':71B 'creat':329C 'cve':13A,16A 'del':286C 'destruct':340C 'devic':218C 'disconn':290C 'drop':97C 'ebadfd':245C 'event':192C,296C 'evt':292C 'exist':248C 'follow':82C,188C 'free':12A,61B,270C 'freed':51B,332C 'hci':217C,289C,295C,300C 'hdev':109C 'hold':274C,281C 'host':25B 'instrument':261C 'intact':185C 'interv':232C 'iso':34B,65B,88C,94C,103C,150C,173C,206C,223C,272C,279C,284C,327C,343C 'iso_sock_alloc.constprop':323C 'kasan':56B,257C,265C 'kernel':2A,20B,73B,80C,262C 'kfree':336C 'later':50B,191C 'leak':177C 'leav':41B,182C 'linux':1A,21B,79C 'listen':6A,28B,92C,96C,104C,114C,149C,224C,239C 'lock':100C,110C,135C,221C 'memori':76B 'null':212C 'observ':124C 'one':42B 'order':111C 'overwrit':172C 'packet':297C 'path':68B,250C 'pi':174C,207C 'point':44B 'preserv':107C 'prot':310C 'public':236C 'publish':147C 'recheck':201C 'record':256C 'refer':180C 'reject':89C,240C 'releas':133C,345C,349C 'report':258C 'requir':205C 'resolv':86C 'runtim':22B 'rx':301C 'second':170C 'self':24B 'self-host':23B 'setup':93C,243C 'show':54B,263C 'simultan':27B 'sk':175C,184C,208C,309C,314C,339C 'slab':58B,267C 'slab-use-after-fre':57B,266C 'sock':95C,273C,280C,319C,328C,344C,348C,352C 'socket':36B,47B,99C,120C,159C,164C,186C,199C,220C 'sourc':53B 'stale':198C 'take':214C 'task':307C,334C 'teardown':67B,187C 'therefor':122C 'trace':278C 'two':26B,39B,112C 'unlock':249C 'use':10A,59B,268C 'use-after-fre':9A 'vulner':83C 'whether':154C,162C 'work':302C 'x10/0x20':355C 'x113/0x220':313C 'x119/0x1f0':276C,283C 'x121/0x3c0':338C 'x19/0x300':326C 'x29/0x370':322C 'x293/0x730':304C 'x29d/0x340':347C 'x2b/0x6d0':317C 'x351/0x8c0':294C 'x42b/0x540':342C 'x71b/0xb20':299C 'x94/0x100':331C 'xa1/0x260':351C 'xe4/0x270':288C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with Bluetooth ISO (LE Audio broadcast) support that use broadcast sockets, where a local process can call listen() concurrently. Hosts without Bluetooth hardware or with the Bluetooth stack disabled are unlikely to be exposed. The sources do not say which distributions or kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99013","severity":null,"published_at":"2026-10-23T13:17:24+00:00","modified_at":"2026-10-23T13:17:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99013","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99013","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}