CVE-2026-99013 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux systems with Bluetooth support should assess exposure and prioritize patching and verification of Linux kernel versions. They should also monitor kernel logs for signs of exploitation and implement compensating controls for exposed systems.

Why it matters

A use-after-free vulnerability in the Linux kernel's Bluetooth ISO implementation can lead to denial of service or potentially arbitrary code execution. Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux systems with Bluetooth support should assess exposure and prioritize patching and verification of Linux kernel versions.

• Denial of service due to use-after-free error
• Potential for arbitrary code execution
• Need for patching and verification of Linux kernel versions
• Importance of monitoring kernel logs for signs of exploitation

Technical summary

The Linux kernel's Bluetooth ISO implementation is vulnerable to a use-after-free error. When setting up concurrent BIS listeners, a race condition can lead to a socket's connection being overwritten, causing a use-after-free error when the socket is torn down. This can be exploited by a local attacker to cause a denial of service or potentially execute arbitrary code. The vulnerability is caused by a race condition between concurrent listen() calls on the same broadcast socket. A recorded KASAN report from an instrumented kernel shows a use-after-free error.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Restrict access to the Bluetooth service to trusted users
• Monitor kernel logs for signs of exploitation
• Perform a thorough review of the system for potential indicators of compromise
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was introduced in the Linux kernel's Bluetooth ISO implementation. A recorded KASAN report from an instrumented kernel shows a use-after-free error. The issue is caused by a race condition between concurrent listen() calls on the same broadcast socket.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.