CVE-2026-80721High· 8.8▾ Twilight

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in iso_conn After iso_conn_del(), ISO sockets should not dereference the hcon any more

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in iso_conn After iso_conn_del(), ISO sockets should not dereference the hcon any more. Currently, clearing iso_con…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score48/ 100 · Moderate

impact 48.4 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 28, 2026

Updated

Aug 30, 2026

CVSS

8.8

Vendor

—

Product

—

CWE

—

Depth score

48 · Moderate

EPSS

0.22% · p13

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Aug 30.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 2 days

Aug 28, 2026Published
Disclosed via NVD
Aug 30, 2026Record revised
Last analysed / modified upstream
Aug 30, 2026EPSS first tracked
0.2%

#nvd

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: ensure no dangling hcon references in iso_conn

After iso_conn_del(), ISO sockets should not dereference the hcon any more. Currently, clearing iso_conn::hcon relies on iso_conn_del() releasing the last reference to the iso_conn.

Simplify this by explicitly clearing conn->hcon in iso_conn_del(), to avoid more complex reasoning on races about who holds the last reference.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References