https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 20:09:32 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-99012 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: ISO: Serialize concurrent connect calls</p> <p>iso_sock_connect() checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check while the socket is open or bound.</p> <p>Caller A can copy its destination for route selection, then caller B can replace the socket destination before A binds or connects the CIS. A then uses B&#39;s destination with the route selected for its own request. B can also proceed after A attaches a connection and sets BT_CONNECT. For deferred BIS setup, B can bind a second BIS and overwrite iso_pi(sk)-&gt;conn, leaving the first connection&#39;s reference and conn-&gt;sk back-pointer stranded. Concurrent CIS connects can likewise replace the socket&#39;s connection. Later teardown only detaches the current connection, so a callback on the old connection can race with socket release and access a freed socket.</p> <p>KASAN reported:</p> <p>BUG: KASAN: slab-use-after-free in iso_sock_hold+0xf7/0x1b0 Call Trace: iso_sock_hold+0xf7/0x1b0 iso_conn_del+0x7b/0x1d0 iso_connect_cfm+0x186/0x16a0 hci_conn_failed+0x154/0x280 hci_abort_conn_sync+0x3dc/0x7d0 hci_cmd_sync_work+0x173/0x300</p> <p>Allocated by task 121: sk_alloc+0x2b/0x6d0 bt_sock_alloc+0x29/0x370 iso_sock_alloc.constprop.0+0x19/0x300 iso_sock_create+0x94/0x100</p> <p>Freed by task 121: kfree+0x121/0x3c0 __sk_destruct+0x42b/0x540 iso_sock…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: ISO: Serialize concurrent connect calls</p> <p>iso_sock_connect() checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check while the socket is open or bound.</p> <p>Caller A can copy its destination for route selection, then caller B can replace the socket destination before A binds or connects the CIS. A then uses B&#39;s destination with the route selected for its own request. B can also proceed after A attaches a connection and sets BT_CONNECT. For deferred BIS setup, B can bind a second BIS and overwrite iso_pi(sk)-&gt;conn, leaving the first connection&#39;s reference and conn-&gt;sk back-pointer stranded. Concurrent CIS connects can likewise replace the socket&#39;s connection. Later teardown only detaches the current connection, so a callback on the old connection can race with socket release and access a freed socket.</p> <p>KASAN reported:</p> <p>BUG: KASAN: slab-use-after-free in iso_sock_hold+0xf7/0x1b0 Call Trace: iso_sock_hold+0xf7/0x1b0 iso_conn_del+0x7b/0x1d0 iso_connect_cfm+0x186/0x16a0 hci_conn_failed+0x154/0x280 hci_abort_conn_sync+0x3dc/0x7d0 hci_cmd_sync_work+0x173/0x300</p> <p>Allocated by task 121: sk_alloc+0x2b/0x6d0 bt_sock_alloc+0x29/0x370 iso_sock_alloc.constprop.0+0x19/0x300 iso_sock_create+0x94/0x100</p> <p>Freed by task 121: kfree+0x121/0x3c0 __sk_destruct+0x42b/0x540 iso_sock…</p> https://db.gcve.eu/vuln/fkie_cve-2026-99012 https://db.gcve.eu/vuln/ghsa-g55x-63cp-x552 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: ISO: Serialize concurrent connect calls</p> <p>iso_sock_connect() checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check while the socket is open or bound.</p> <p>Caller A can copy its destination for route selection, then caller B can replace the socket destination before A binds or connects the CIS. A then uses B&#39;s destination with the route selected for its own request. B can also proceed after A attaches a connection and sets BT_CONNECT. For deferred BIS setup, B can bind a second BIS and overwrite iso_pi(sk)-&gt;conn, leaving the first connection&#39;s reference and conn-&gt;sk back-pointer stranded. Concurrent CIS connects can likewise replace the socket&#39;s connection. Later teardown only detaches the current connection, so a callback on the old connection can race with socket release and access a freed socket.</p> <p>KASAN reported:</p> <p>BUG: KASAN: slab-use-after-free in iso_sock_hold+0xf7/0x1b0 Call Trace: iso_sock_hold+0xf7/0x1b0 iso_conn_del+0x7b/0x1d0 iso_connect_cfm+0x186/0x16a0 hci_conn_failed+0x154/0x280 hci_abort_conn_sync+0x3dc/0x7d0 hci_cmd_sync_work+0x173/0x300</p> <p>Allocated by task 121: sk_alloc+0x2b/0x6d0 bt_sock_alloc+0x29/0x370 iso_sock_alloc.constprop.0+0x19/0x300 iso_sock_create+0x94/0x100</p> <p>Freed by task 121: kfree+0x121/0x3c0 __sk_destruct+0x42b/0x540 iso_sock…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: ISO: Serialize concurrent connect calls</p> <p>iso_sock_connect() checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check while the socket is open or bound.</p> <p>Caller A can copy its destination for route selection, then caller B can replace the socket destination before A binds or connects the CIS. A then uses B&#39;s destination with the route selected for its own request. B can also proceed after A attaches a connection and sets BT_CONNECT. For deferred BIS setup, B can bind a second BIS and overwrite iso_pi(sk)-&gt;conn, leaving the first connection&#39;s reference and conn-&gt;sk back-pointer stranded. Concurrent CIS connects can likewise replace the socket&#39;s connection. Later teardown only detaches the current connection, so a callback on the old connection can race with socket release and access a freed socket.</p> <p>KASAN reported:</p> <p>BUG: KASAN: slab-use-after-free in iso_sock_hold+0xf7/0x1b0 Call Trace: iso_sock_hold+0xf7/0x1b0 iso_conn_del+0x7b/0x1d0 iso_connect_cfm+0x186/0x16a0 hci_conn_failed+0x154/0x280 hci_abort_conn_sync+0x3dc/0x7d0 hci_cmd_sync_work+0x173/0x300</p> <p>Allocated by task 121: sk_alloc+0x2b/0x6d0 bt_sock_alloc+0x29/0x370 iso_sock_alloc.constprop.0+0x19/0x300 iso_sock_create+0x94/0x100</p> <p>Freed by task 121: kfree+0x121/0x3c0 __sk_destruct+0x42b/0x540 iso_sock…</p> https://db.gcve.eu/vuln/ghsa-g55x-63cp-x552