Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: fix UAF in iso_recv_frame
iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock before using sk, with no reference held. A concurrent iso_sock_kill() can free sk in that window, causing use-after-free on sk->sk_state and sock_queue_rcv_skb().
Fix by replacing the bare pointer read with iso_sock_hold(conn), which calls sock_hold() while the spinlock is held, atomically elevating the refcount before the lock drops. Add a drop_put label so sock_put() is called on all exit paths where the hold succeeded.
Details
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| AlmaLinux 10 | In Rollout |
63 kernels
|
| Debian 12 | Planned | — |
| Oracle Linux 10 | In Rollout |
49 kernels
|
| RHEL 10 | In Rollout |
64 kernels
|
| RHEL 9 | Planned | — |
| Rocky Linux 10 | In Rollout |
47 kernels
|