Look up another CVE · open CVE-2026-53276 in the interactive tracker
CVE-2026-53276
Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer
Published 2026-06-25 (4 months ago) by the Linux kernel CNA. Subsystem net/bluetooth. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-53276 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
In iso_sock_rebind_bc(), the bis pointer is cached, then the socket lock is dropped: bis = iso_pi(sk)->conn->hcon; /* Release the socket before lookups since that requires hci_dev_lock * which shall not be acquired while holding sock_lock for proper * ordering. */ release_sock(sk); hci_dev_lock(bis->hdev); During the unlocked window, could a concurrent close() destroy the connection and free the bis structure, causing hci_dev_lock(bis->hdev) to access memory after it is freed, fix this by using the hdev reference which was safely acquired via iso_conn_get_hdev().
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/bluetooth/iso.c
- What this is
- BLUETOOTH SUBSYSTEMMAINTAINERS section matched on net/bluetooth/ · linux-bluetooth@vger.kernel.org · Supported
- Kernel module
- bluetooth
Check it on the machine
grep -wE 'CONFIG_BT|CONFIG_BT_LE' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w bluetoothPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_BT, CONFIG_BT_LE
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-06-25 (4 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.11%, higher than 1.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- net/bluetooth
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.19 | 7.0.13 | d324b8aa20bd |
| 6.19 | 7.1 | f50331f2a144 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable path is reached through local AF_BLUETOOTH ISO socket operations, specifically bind() rebinding on an already connected or CONNECT2 ISO socket. An adjacent Bluetooth peer may be involved in establishing BIS/PAST state, but the actual trigger is a local syscall/race, not an unauthenticated received packet alone.
- AC:LAttack complexity, low
- The bug is a use-after-free race where the rebind path drops the socket lock and a concurrent close can free the cached hci_conn pointer. A local attacker can control both sides by using concurrent operations on their own socket, so no uncontrollable condition is required.
- PR:LPrivileges required, low
- The ISO socket create/bind/connect/rebind path has no CAP_NET_ADMIN or CAP_NET_RAW check, but it requires the attacker to run local code and create/use a Bluetooth ISO socket. This is therefore basic unprivileged local access rather than real administrative privilege.
- UI:NUser interaction, none
- No victim user action is required once the attacker can run local code; the attacker can create the socket state and trigger the concurrent bind/close race themselves.
- S:UScope, unchanged
- The vulnerable code is in the kernel Bluetooth stack and impacts the same kernel security authority. There is no VM escape, IOMMU bypass, or other cross-scope boundary indicated.
- C:HConfidentiality impact, high
- This is a use-after-free of an hci_conn pointer, and under the required higher-severity rule UAFs are treated as capable of enabling memory disclosure through heap reuse and object manipulation.
- I:HIntegrity impact, high
- A kernel use-after-free can potentially be shaped into control-flow or data-structure corruption via heap spraying/reuse. Under the required higher-severity rule, this supports high integrity impact.
- A:HAvailability impact, high
- The stale hci_conn dereference can access freed memory while taking hci_dev_lock(bis->hdev), which can oops or panic the kernel. A repeatable local trigger gives high availability impact.