Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by iso_conn_free(). There are two cases where iso_chan_add() does not create an association: it returns success when the socket is already attached to the same iso_conn, and it returns -EBUSY when another socket is attached. The hold returned for the current call is unused in both cases. This occurs when deferred setup calls iso_connect_cis() again for its existing socket, or when another socket attempts to reuse the CIS. Detect the idempotent case while the connection is locked and release the unused hold after iso_chan_add(). Also release it on -EBUSY. Do not drop it for other errors: a newly allocated iso_conn releases the transferred hold when its last temporary reference is put.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
69997d50ec574be816b4ee8f9cee52ebbd53f8bd to < e0e8b70207eaf27aee0a05ec5bf2d1b6bcb004d1affected69997d50ec574be816b4ee8f9cee52ebbd53f8bd to < ed4c026cc4094dfb7a329b9d8df0ddd0be1b2458affected69997d50ec574be816b4ee8f9cee52ebbd53f8bd to < e5fcca51177f224604e3a8c926ffd5edbeb58b09affected69997d50ec574be816b4ee8f9cee52ebbd53f8bd to < 0fcd4dad555c96e0bd3a1b8c569f989be85c7341affected
Linux Linux
Default version status: affected
6.6affected0 to < 6.6unaffected6.12.113 to ≤ 6.12.*unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected