CVE-2026-63945
Received Received - Intake

Bluetooth Use-After-Free in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock iso_sock_close() calls iso_sock_clear_timer() before acquiring lock_sock(sk). iso_sock_clear_timer() reads iso_pi(sk)->conn twice without the socket lock held: if (!iso_pi(sk)->conn) return; cancel_delayed_work(&iso_pi(sk)->conn->timeout_work); Concurrently, iso_conn_del() executes under lock_sock(sk) and calls iso_chan_del(), which sets iso_pi(sk)->conn to NULL and may result in the final reference to the connection being dropped: CPU0 CPU1 ---- ---- iso_sock_clear_timer() if (conn != NULL) ... lock_sock(sk) iso_chan_del() iso_pi(sk)->conn = NULL cancel_delayed_work(conn) /* NULL deref or UAF */ iso_pi(sk)->conn is not stable across the unlock window, causing a NULL pointer dereference or use-after-free. Serialize iso_sock_clear_timer() with the socket lock by moving it inside lock_sock()/release_sock(), matching the pattern used in iso_conn_del() and all other call sites.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63945
EUVD
EUVD-2026-45718

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition in the Linux kernel's Bluetooth ISO (isochronous) socket handling. The issue occurs when iso_sock_close() calls iso_sock_clear_timer() without holding the socket lock, allowing concurrent access to iso_pi(sk)->conn. This can lead to a NULL pointer dereference or use-after-free when iso_conn_del() modifies the same pointer under the socket lock.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth ISO socket implementation and may not have direct network detection commands. Focus on kernel version checks and Bluetooth stack monitoring. Use 'uname -a' to check kernel version and look for patches addressing CVE-2026-63945. Monitor kernel logs for Bluetooth-related crashes or NULL pointer dereferences.

Impact Analysis

If exploited, this could cause kernel crashes, denial-of-service, or potential privilege escalation. It specifically affects Bluetooth ISO socket operations, which are used for time-sensitive data transfers.

Compliance Impact

This vulnerability is a Linux kernel Bluetooth ISO socket use-after-free issue. It does not directly impact compliance with GDPR, HIPAA, or similar standards as it is a low-level system bug rather than a data protection or privacy violation.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution. If patches are unavailable, consider disabling Bluetooth ISO sockets if not required. Monitor kernel logs for Bluetooth-related errors and update to a patched kernel version as soon as possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63945. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart