CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's Bluetooth subsystem, specifically in the handling of socket connections during the ISO connection readiness phase. It can lead to a use-after-free (UAF) condition due to improper reference counting and locking, potentially allowing an attacker to exploit this flaw for arbitrary code execution or denial of service. Organizations using Linux systems with Bluetooth capabilities should prioritize patching this vulnerability to mitigate the risk of exploitation.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in iso_conn_ready sk deref in iso_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either: [Task 1] [Task 2] iso_sock_release iso_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) iso_sock_kill(sk) UAF on sk deref Fix possible UAF by holding sk refcount in iso_conn_ready(). Also recheck after lock_sock that the socket is still valid. Adjust locking so conn->sk is cleared only under lock_sock.