important · Bluetooth — Linux
A nearby unpaired LE Audio peer can race Linux into a kernel use-after-free.
Affects
Linux kernel Bluetooth ISO socket handling on systems using LE Audio broadcast or unicast.
Concurrent ISO-listener teardown can leave a child socket linked to a freed parent that later teardown code dereferences and modifies.
Detail and 2 sources
That supplies a kernel heap write primitive, but no real-controller reproduction or hardened-kernel control-flow hijack is public.
Linux has published affected and fixed release boundaries.