SECURITY ANNOUNCEMENT

CVE-2026-99012

23 October 2026

so the temporary iso_conn_put() frees the ISO candidate and drops its HCI hold on rejection. iso_conn_ready() uses a freshly allocated, unpublished child with no connection, making the socket-side rejection

Introduced

6.0ccf74f2390d60a2f9a75ef496d2564abb478f46a

Fixed releases

6.12.1131adcfe232c0f58890c2538211a841100ad0512bd

6.18.57c6489a3a0ac8c07f64cb5b44f005bc518f1048ac

6.6.1609b6ed57eb8c892ee7566b8c1bd06fdd0053b53de

7.2.113728f6b0d5990c0d500e929ba10baf93bee24f5e

7.3e32d80293a0e1a160d5e5101daa8c82148c07510

View source announcement ↗