SB20261023142 - Use-after-free in Linux kernel bluetooth

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-99013)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth ISO socket implementation when concurrent listen() calls configure the same broadcast socket. A local user can race these calls to overwrite the socket's connection pointer while leaving an earlier connection referencing the socket, causing subsequent Bluetooth events to access freed socket memory after socket teardown and potentially crash the kernel.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/555ff78fa719f50ff4cdbdb40aa1acc6e8e327d3
• https://git.kernel.org/stable/c/559e4d2b6f83aaa96061659cc7104b7a0293f9ef
• https://git.kernel.org/stable/c/79993e9919a87068183ba3622c383f05c049c4bc
• https://git.kernel.org/stable/c/90b744066ca520d1a6a505a11ade9c9a5f48accf