CVE-2026-53276: Linux Kernel Bluetooth ISO Use-After-Free Vulnerability

Technical summary

CVE-2026-53276 is a use-after-free vulnerability (CWE-416) in the Linux kernel's Bluetooth ISO layer, specifically in the iso_sock_rebind_bc() function. The vulnerability occurs when a bis (Broadcast ISO Set) pointer is cached from iso_pi(sk)->conn->hcon, the socket lock is released to perform a blocking hci_dev_lock operation, and a concurrent close() call destroys the connection structure during that unlocked window. Subsequent dereferencing of the freed bis pointer causes a use-after-free condition. The fix involves obtaining a safe reference to the hci_device via iso_conn_get_hdev() prior to releasing the socket lock, eliminating the stale pointer dereference.

Business impact

This vulnerability could allow a local, authenticated attacker to crash the Linux kernel through a malformed Bluetooth ISO socket sequence, resulting in denial of service. While a direct privilege escalation vector has not been confirmed, use-after-free bugs in kernel memory management can potentially be exploited to read or write kernel memory, depending on heap feng-shui and mitigation effectiveness. Systems relying on Bluetooth connectivity and running vulnerable kernels face operational risk.

Affected systems

The Linux kernel is affected; specific version ranges depend on when the vulnerable code was introduced and when patches are released. Distributions and embedded systems shipping the affected kernel—particularly those with Bluetooth ISO support enabled—are impacted. The vulnerability requires local access and is not remotely exploitable. Check your kernel version and distribution advisories against the official Linux kernel patch repository.

Exploitability

This is a local privilege level vulnerability (CVSS:3.1/AV:L/AC:L/PR:L) with low attack complexity. Exploitation requires a local user and basic capability to open and manipulate Bluetooth ISO sockets. The race condition window may be narrow, but deterministic exploitation is possible through deliberate concurrent socket operations. The vulnerability does not appear to be in any known exploit frameworks at this time and is not tracked in the CISA KEV catalog.

Remediation

Apply the kernel patch that replaces the unsafe bis pointer caching with a reference obtained via iso_conn_get_hdev(), which safely maintains a reference to the hci_device across the unlock/lock window. Verify the patch details against your Linux distribution's security advisory or the kernel.org patch repository. Most major distributions will release updated kernel packages; prioritize systems handling Bluetooth ISO traffic.

Patch guidance

Obtain the patched kernel version from your Linux distribution's security repositories. Kernel patches for this vulnerability address the iso_sock_rebind_bc() function to use a safe hci_device reference rather than a cached connection pointer. Verify the patch has been integrated into your target kernel version before deployment. Reboot is required to activate kernel changes. For systems unable to patch immediately, consider disabling Bluetooth ISO if the system's workload permits.

Detection guidance

Monitor kernel logs for use-after-free errors or NULL pointer dereference panics related to Bluetooth ISO or HCI device operations. Dynamic analysis tools such as KASAN (Kernel Address Sanitizer) can detect this vulnerability when enabled at build time. Runtime detection is difficult without instrumentation; focus detection efforts on patch verification and version auditing. In production, watch for unexpected kernel crashes coinciding with Bluetooth ISO socket activity.

Why prioritize this

Although not yet in CISA's KEV catalog, this high-severity (CVSS 7.8) local kernel vulnerability affecting a widely used subsystem warrants expedited patching. The low attack complexity and requirement for only basic local privileges mean any multi-user Linux system or container environment is at risk. Availability impact is immediate (denial of service); confidentiality and integrity risks are potential but serious. Prioritize patching systems with multiple local users or those running Bluetooth-intensive workloads.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a local vector (no remote exploitation), low attack complexity (standard race condition, no special tools needed), and complete compromise of availability plus potential compromise of confidentiality and integrity. The severity is elevated by the kernel-level impact and the broad presence of affected components. Organizations must assess their exposure based on local user population and Bluetooth ISO adoption.

Frequently asked questions