bluetooth IsoConn UAF

Vulnerability analysis

A race condition in the Bluetooth ISO connection teardown path allows a connection object to retain a dangling pointer to its underlying HCI connection after that connection has been removed. The original code relied on reference counting to implicitly clear the pointer, so if another thread still held a reference to the ISO connection, the stale HCI connection pointer could be dereferenced, leading to use-after-free. The fix explicitly nullifies the pointer under the connection lock at the end of teardown and adds a guard that refuses to attach new channels to a connection whose HCI connection is already gone. This is reachable by an attacker within Bluetooth range who can trigger ISO connection setup and teardown, or by a local process with access to Bluetooth sockets; no special system privileges are required.