CVE-2026-80721Bluetooth: ISO: ensure no dangling hcon references in iso_conn
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in iso_conn After iso_conn_del(), ISO sockets should not dereference the hcon any more. Currently, clearing iso_conn::hcon relies on iso_conn_del() releasing the last reference to the iso_conn. Simplify this by explicitly clearing conn->hcon in iso_conn_del(), to avoid more complex reasoning on races about who holds the last reference.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from dc26097bdb864a0d5955b9a25e43376ffc1af99b before e941799c31f68e67ce0976efb38a79101f921b64; from dc26097bdb864a0d5955b9a25e43376ffc1af99b before cdce8af9291d8a1f8916c271de029bf558d9e8ec; from dc26097bdb864a0d5955b9a25e43376ffc1af99b before aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb; f53e7489273dc2bb307bf50f319b3762d45534f0; a58d0f5dac322e16cc75334d000666512341bde5; from 6.11.11 before 6.12; from 6.12.2 before 6.13 | CNA record |
References
- https://git.kernel.org/stable/c/e941799c31f68e67ce0976efb38a79101f921b64
- https://git.kernel.org/stable/c/cdce8af9291d8a1f8916c271de029bf558d9e8ec
- https://git.kernel.org/stable/c/aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.