Re: Fwd: Use-after-free in net/bluetooth/iso.c (iso_sock_connect race)

Hi,

pe, 2026-08-07 kello 13:36 +0300, vova tokarev kirjoitti:
> It's been almost two months since I reported this, and I haven't heard
> back. Reaching out to you directly as the Bluetooth maintainer.
> 
> The bug: iso_sock_connect() in net/bluetooth/iso.c drops the socket lock
> (release_sock at line 1118) BEFORE iso_connect_cis() acquires
> hci_dev_lock. During this window, a concurrent HCI Disconnection
> Complete event can free the iso_conn via iso_conn_del() ->
> iso_conn_free(), resulting in use-after-free when iso_connect_cis()
> subsequently accesses it.

I'm not maintainer, but there are several UAF fixes for iso_conn races
in iso.c in v7.2-rc6

Probably useful if you could verify whether the KASAN crash still
reproduces on that version.

-- 
Pauli Virtanen