CVE-2026-80721: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80721 is a use-after-free vulnerability in the Linux kernel's Bluetooth ISO layer, caused by dangling hcon (HCI connection) references in iso_conn after iso_conn_del() is called. The flaw arises because clearing iso_conn::hcon previously relied on iso_conn_del() releasing the last reference to the iso_conn, creating a race condition window where ISO sockets could dereference a freed hcon. Affected versions include Linux kernel releases before 6.18.44 and before 7.1.8; kernel 7.2 and later are unaffected. The vulnerability was published on August 28, 2026, with patches available in the same timeframe. The CVSS base score is currently listed as 0.0 with an estimated severity of Medium (GitHub Advisory, Feedly).

The root cause is a use-after-free (CWE-416) condition in the Linux kernel's Bluetooth ISO socket implementation (net/bluetooth/iso.c). When iso_conn_del() is invoked, the iso_conn::hcon pointer is not explicitly cleared, meaning that if another code path holds a reference to the iso_conn and later dereferences hcon, it accesses already-freed memory. The fix explicitly sets conn->hcon = NULL within iso_conn_del(), eliminating the ambiguity about reference ownership and preventing the dangling pointer dereference. Exploitation requires local access and the ability to perform malicious Bluetooth ISO socket operations to trigger the race condition (GitHub Advisory, Kernel Patch).

Successful exploitation of this vulnerability could allow a local attacker to trigger memory corruption through the dangling hcon pointer, potentially leading to kernel crashes (denial of service) or arbitrary code execution in kernel context. If code execution is achieved, an attacker could escalate privileges to root, compromising the full confidentiality, integrity, and availability of the affected system. The scope is limited to systems with Bluetooth ISO socket support enabled and accessible to local users (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-80721 as of the disclosure date. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to a system with Bluetooth ISO socket functionality, which limits the attack surface (GitHub Advisory).

The Linux kernel project has released patches addressing this vulnerability. Users should upgrade to kernel version 6.18.44 or later in the 6.18.x series, or 7.1.8 or later in the 7.1.x series; kernel 7.2 and above are unaffected. The fix is available via the stable kernel tree at the following commits: e941799c31f6, cdce8af9291d, and aa9f7cb2bd3a. As a temporary workaround where patching is not immediately possible, disabling Bluetooth ISO socket support or restricting local user access to Bluetooth interfaces can reduce exposure (GitHub Advisory, Kernel Patch).