CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's Bluetooth subsystem, specifically in the iso_recv_frame function, which improperly handles a socket reference, leading to a use-after-free condition. This flaw can be exploited by an attacker to potentially execute arbitrary code or crash the system, making it critical for organizations using Linux-based systems with Bluetooth capabilities to prioritize patching. System administrators and security teams should address this vulnerability promptly to mitigate risks associated with unauthorized access or service disruptions.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in iso_recv_frame iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock before using sk, with no reference held. A concurrent iso_sock_kill() can free sk in that window, causing use-after-free on sk->sk_state and sock_queue_rcv_skb(). Fix by replacing the bare pointer read with iso_sock_hold(conn), which calls sock_hold() while the spinlock is held, atomically elevating the refcount before the lock drops. Add a drop_put label so sock_put() is called on all exit paths where the hold succeeded.