---
id: CVE-2025-40141
title: 'Bluetooth: ISO: Fix possible UAF on iso_conn_free'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: ISO: Fix possible UAF on iso_conn_free

  This attempt to fix similar issue to sco_conn_free where if the
  conn->sk is not set to NULL may lead to UAF on iso_co…
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    eba6d787ec117a5d2c60f9644e0a39c18542b6be
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    5319145a07d8bf5b0782b25cb3115825689d42bb
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    80689777919f02328eb873769de4647c9dd3e371
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    c92ad1a155ccfa38b87bd1d998287e1c0a24248d
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8
  - Linux 6.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:57:17.170509Z'
published: '2025-11-12'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:02:38.774Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-40141'
references:
  - url: 'https://git.kernel.org/stable/c/eba6d787ec117a5d2c60f9644e0a39c18542b6be'
  - url: 'https://git.kernel.org/stable/c/5319145a07d8bf5b0782b25cb3115825689d42bb'
  - url: 'https://git.kernel.org/stable/c/80689777919f02328eb873769de4647c9dd3e371'
  - url: 'https://git.kernel.org/stable/c/c92ad1a155ccfa38b87bd1d998287e1c0a24248d'
  - url: 'https://git.kernel.org/stable/c/9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8'
tags:
  - cve.org
epss: 0.00324
epssPercentile: 0.23768
ingestedAt: '2026-10-15T22:48:25.547Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Fix possible UAF on iso_conn_free

This attempt to fix similar issue to sco_conn_free where if the
conn->sk is not set to NULL may lead to UAF on iso_conn_free.

## Affected

- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < eba6d787ec117a5d2c60f9644e0a39c18542b6be`
- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 5319145a07d8bf5b0782b25cb3115825689d42bb`
- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 80689777919f02328eb873769de4647c9dd3e371`
- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < c92ad1a155ccfa38b87bd1d998287e1c0a24248d`
- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.