{
  "cveId": "CVE-2026-99013",
  "url": "https://patchblox.com/security/cve/CVE-2026-99013",
  "summary": "CVE-2026-99013 is fixed in 11 products on 1 platform, first by DEBIAN-CVE-2026-99013, released October 24, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: ISO: Reject concurrent BIS listener s...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: ISO: Reject concurrent BIS listener setup  iso_sock_listen() drops the socket lock before calling iso_listen_bis() to preserve the hdev-\u003Elock ordering. Two concurrent listen() calls on the same broadcast socket can therefore both observe BT_BOUND. Caller A can attach connA and release the locks, then caller B can acquire them and attach connB before A publishes BT_LISTEN.  __iso_chan_add() checks whether connB already has a socket, but not whether the socket already has a connection. The second attachment overwrites iso_pi(sk)-\u003Econn, leaking the connA reference and leaving connA-\u003Esk intact. Socket teardown follows connB, so later events on connA can cause a stale socket access.  Recheck BT_BOUND and require iso_pi(sk)-\u003Econn to be NULL after taking both the HCI device and socket locks in iso_listen_bis(). The connection check also covers the interval between attachment and publication of BT_LISTEN. Reject a competing setup with -EBADFD through the existing unlock path before allocating another connection.  A recorded KASAN report from an instrumented kernel shows:    BUG: KASAN: slab-use-after-free in iso_sock_hold\u002B0x119/0x1f0   Call Trace:    iso_sock_hold\u002B0x119/0x1f0    iso_conn_del\u002B0xe4/0x270    hci_disconn_complete_evt\u002B0x351/0x8c0    hci_event_packet\u002B0x71b/0xb20    hci_rx_work\u002B0x293/0x730    Allocated by task 93:    sk_prot_alloc\u002B0x113/0x220    sk_alloc\u002B0x2b/0x6d0    bt_sock_alloc\u002B0x29/0x370    iso_sock_alloc.constprop.0\u002B0x19/0x300    iso_sock_create\u002B0x94/0x100    Freed by task 93:    kfree\u002B0x121/0x3c0    __sk_destruct\u002B0x42b/0x540    iso_sock_release\u002B0x29d/0x340    __sock_release\u002B0xa1/0x260    sock_close\u002B0x10/0x20",
  "published": "2026-10-23T13:17:24Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00159,
  "epssPercentile": 0.05023,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "kernel-64kb",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-azure",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default-base",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1.150700.17.51.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-docs",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-SLE15-SP7_Update_24",
      "release": "sles 15.7",
      "fixedVersion": "1-150700.15.3.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-build",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-source",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-syms",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.113-1",
      "fix": "DEBIAN-CVE-2026-99013",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99013",
      "released": "2026-10-24T13:25:57Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.11-1",
      "fix": "DEBIAN-CVE-2026-99013",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99013",
      "released": "2026-10-24T13:25:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}