CVE-2026-80914

A flaw was found in the Bluetooth ISO subsystem of the Linux kernel. A use-after-free vulnerability can occur in the iso_conn_ready() function if a listener socket is closed concurrently while a child socket is being created. This can lead to a dangling pointer being dereferenced upon a later disconnect of the child socket, potentially causing system instability or a denial of service.

This vulnerability is rated as Moderate impact by Red Hat because triggering the flaw requires local user access and winning a tight race condition during concurrent socket lifecycle operations. In typical enterprise server deployments, Bluetooth capabilities and associated hardware controllers are rarely enabled or utilized, which substantially limits attack exposure. Red Hat Enterprise Linux 8 and earlier releases do not include the affected code and are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.