---
id: CVE-2026-99013
title: 'Bluetooth: ISO: Reject concurrent BIS listener setup'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: ISO: Reject concurrent BIS listener setup

  iso_sock_listen() drops the socket lock before calling iso_listen_bis()
  to preserve the hdev->lock ordering. Two c…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c541d7b5e17987ed330798b07d4ad508859c1c93 <
    559e4d2b6f83aaa96061659cc7104b7a0293f9ef
  - >-
    Linux >= 168e28305b871d8ec604a8f51f35467b8d7ba05b <
    90b744066ca520d1a6a505a11ade9c9a5f48accf
  - >-
    Linux >= 168e28305b871d8ec604a8f51f35467b8d7ba05b <
    79993e9919a87068183ba3622c383f05c049c4bc
  - >-
    Linux >= 168e28305b871d8ec604a8f51f35467b8d7ba05b <
    555ff78fa719f50ff4cdbdb40aa1acc6e8e327d3
  - Linux >= 6.12.6 < 6.12.113
  - Linux 6.13
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:20:38.612Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99013'
references:
  - url: 'https://git.kernel.org/stable/c/559e4d2b6f83aaa96061659cc7104b7a0293f9ef'
  - url: 'https://git.kernel.org/stable/c/90b744066ca520d1a6a505a11ade9c9a5f48accf'
  - url: 'https://git.kernel.org/stable/c/79993e9919a87068183ba3622c383f05c049c4bc'
  - url: 'https://git.kernel.org/stable/c/555ff78fa719f50ff4cdbdb40aa1acc6e8e327d3'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.536Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Reject concurrent BIS listener setup

iso_sock_listen() drops the socket lock before calling iso_listen_bis()
to preserve the hdev->lock ordering. Two concurrent listen() calls on
the same broadcast socket can therefore both observe BT_BOUND. Caller
A can attach connA and release the locks, then caller B can acquire
them and attach connB before A publishes BT_LISTEN.

__iso_chan_add() checks whether connB already has a socket, but not
whether the socket already has a connection. The second attachment
overwrites iso_pi(sk)->conn, leaking the connA reference and leaving
connA->sk intact. Socket teardown follows connB, so later events on
connA can cause a stale socket access.

Recheck BT_BOUND and require iso_pi(sk)->conn to be NULL after taking
both the HCI device and socket locks in iso_listen_bis(). The connection
check also covers the interval between attachment and publication of
BT_LISTEN. Reject a competing setup with -EBADFD through the existing
unlock path before allocating another connection.

A recorded KASAN report from an instrumented kernel shows:

  BUG: KASAN: slab-use-after-free in iso_sock_hold+0x119/0x1f0
  Call Trace:
   iso_sock_hold+0x119/0x1f0
   iso_conn_del+0xe4/0x270
   hci_disconn_complete_evt+0x351/0x8c0
   hci_event_packet+0x71b/0xb20
   hci_rx_work+0x293/0x730

  Allocated by task 93:
   sk_prot_alloc+0x113/0x220
   sk_alloc+0x2b/0x6d0
   bt_sock_alloc+0x29/0x370
   iso_sock_alloc.constprop.0+0x19/0x300
   iso_sock_create+0x94/0x100

  Freed by task 93:
   kfree+0x121/0x3c0
   __sk_destruct+0x42b/0x540
   iso_sock_release+0x29d/0x340
   __sock_release+0xa1/0x260
   sock_close+0x10/0x20

## Affected

- `Linux >= c541d7b5e17987ed330798b07d4ad508859c1c93 < 559e4d2b6f83aaa96061659cc7104b7a0293f9ef`
- `Linux >= 168e28305b871d8ec604a8f51f35467b8d7ba05b < 90b744066ca520d1a6a505a11ade9c9a5f48accf`
- `Linux >= 168e28305b871d8ec604a8f51f35467b8d7ba05b < 79993e9919a87068183ba3622c383f05c049c4bc`
- `Linux >= 168e28305b871d8ec604a8f51f35467b8d7ba05b < 555ff78fa719f50ff4cdbdb40aa1acc6e8e327d3`
- `Linux >= 6.12.6 < 6.12.113`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.