CVE-2026-63944
Received Received - Intake

Bluetooth Use-After-Free in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was obtained from an RCU-protected iteration over hdev->conn_hash.list and is not valid once these locks are dropped. A concurrent disconnect can free the hci_conn between the unlock and the dereference, causing a use-after-free read. The cancellation mechanism in hci_conn_del() cannot prevent this because hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL: hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL); While hci_conn_del() dequeues with data=conn: hci_cmd_sync_dequeue(hdev, NULL, conn, NULL); Since NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never matches, and the pending work item is not cancelled. Fix this by saving conn->conn_timeout into a local variable while the locks are still held, so the stale conn pointer is never dereferenced after unlock. This is the same class of bug as the one fixed by commit 035c25007c9e ("Bluetooth: hci_sync: Fix UAF on le_read_features_complete") which addressed the identical pattern in a different function. This vulnerability was identified using 0sec.ai, an open-source automated security auditing platform (https://github.com/0sec-labs).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63944
EUVD
EUVD-2026-45717

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's Bluetooth subsystem. It occurs in the hci_sync component when hci_le_create_cis_sync() tries to access conn->conn_timeout after releasing critical locks. The conn pointer becomes invalid if a concurrent disconnect happens, leading to a memory corruption issue.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and requires kernel-level inspection. Detection involves checking kernel logs for Bluetooth-related crashes or examining the kernel version for unpatched code. Use commands like 'dmesg | grep -i bluetooth' or 'journalctl -k | grep -i bluetooth' to look for errors. Ensure your kernel is updated to a version containing the fix.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges. It specifically affects systems using Bluetooth functionality in the Linux kernel.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's Bluetooth subsystem. It does not directly relate to data privacy or security controls required by GDPR or HIPAA. Compliance impact would depend on whether the affected system processes sensitive data via Bluetooth, but the CVE itself does not specify such exposure.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If updating is not immediately possible, consider disabling Bluetooth functionality temporarily until the patch is applied. Monitor security advisories for further updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63944. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart