CVE-2026-80721

A flaw was found in the Linux kernel's Bluetooth ISO (Isochronous Stream) implementation. This vulnerability occurs because the system does not properly clear references to connection handles (hcon) after a connection is deleted. This oversight can lead to unpredictable system behavior or instability, potentially resulting in a denial of service (DoS).

A flaw in the Linux kernel's Bluetooth ISO (Isochronous Stream) implementation was rated by Red Hat Product Security as having Moderate impact. When iso_conn_del() tears down an ISO connection, clearing iso_conn::hcon relies on iso_conn_del() releasing the last reference to the iso_conn. Because of this, under a race between connection teardown and socket access, ISO socket code can retain and later dereference a dangling hcon pointer, that is, an hci_conn that should no longer be used. Such a stale pointer dereference can cause a kernel panic, resulting in a denial of service. Triggering the issue requires access to a system whose kernel includes the Bluetooth ISO implementation and depends on precise timing of the teardown race, which is reflected in Red Hat's CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The upstream CVE.org severity is Important (CVSS 3.1 score 8.8); Red Hat rates this flaw lower because the practical impact is limited to availability, and successful triggering requires local access with low privileges and race timing rather than unauthenticated remote code execution.

Red Hat Enterprise Linux 6, 7, and 8 (kernel and kernel-rt) are not affected because the vulnerable code is not present in those streams. RHEL 9, RHEL 10, and Red Hat In-Vehicle OS 2 kernel components are affected. For these affected products the fix is currently deferred to a future update rather than shipped immediately, so the residual risk remains a potential kernel panic (denial of service) if the connection-teardown race is triggered on a system using Bluetooth ISO connections.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.