CVE-2026-53276

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer<br /> <br /> In iso_sock_rebind_bc(), the bis pointer is cached, then the socket lock is<br /> dropped:<br /> bis = iso_pi(sk)-&gt;conn-&gt;hcon;<br /> /* Release the socket before lookups since that requires hci_dev_lock<br /> * which shall not be acquired while holding sock_lock for proper<br /> * ordering.<br /> */<br /> release_sock(sk);<br /> hci_dev_lock(bis-&gt;hdev);<br /> <br /> During the unlocked window, could a concurrent close() destroy the connection<br /> and free the bis structure, causing hci_dev_lock(bis-&gt;hdev) to access memory<br /> after it is freed, fix this by using the hdev reference which was safely<br /> acquired via iso_conn_get_hdev().