CVE-2026-53276

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer

In isosockrebindbc(), the bis pointer is cached, then the socket lock is dropped: bis = isopi(sk)->conn->hcon; /* Release the socket before lookups since that requires hcidevlock * which shall not be acquired while holding socklock for proper * ordering. */ releasesock(sk); hcidevlock(bis->hdev);

During the unlocked window, could a concurrent close() destroy the connection and free the bis structure, causing hcidevlock(bis->hdev) to access memory after it is freed, fix this by using the hdev reference which was safely acquired via isoconnget_hdev().