CVE-2026-63946
Received Received - Intake

Bluetooth Use-After-Free in Linux Kernel Bluetooth ISO

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in iso_recv_frame iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock before using sk, with no reference held. A concurrent iso_sock_kill() can free sk in that window, causing use-after-free on sk->sk_state and sock_queue_rcv_skb(). Fix by replacing the bare pointer read with iso_sock_hold(conn), which calls sock_hold() while the spinlock is held, atomically elevating the refcount before the lock drops. Add a drop_put label so sock_put() is called on all exit paths where the hold succeeded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63946
EUVD
EUVD-2026-45719

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's Bluetooth ISO (isochronous) protocol implementation. It occurs when the iso_recv_frame function reads a pointer to a socket structure while holding a lock but uses it after releasing the lock without holding a reference. A concurrent operation can free the socket, leading to memory corruption when the original code tries to access the freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth ISO implementation and may not have direct detection commands. Monitor kernel logs for Bluetooth-related crashes or errors after applying updates. Check for unusual Bluetooth activity or unexpected kernel panics.

Impact Analysis

If exploited, this vulnerability could allow an attacker to crash the system or potentially execute arbitrary code with kernel privileges. This could lead to denial of service, privilege escalation, or unauthorized access to sensitive data on systems running vulnerable Linux kernel versions with Bluetooth ISO support enabled.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's Bluetooth ISO implementation. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than kernel-level memory corruption bugs.

Mitigation Strategies

Apply the latest Linux kernel updates that include the fix for this vulnerability. Reboot the system to ensure the updated kernel is active. Disable Bluetooth services temporarily if immediate patching is not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63946. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart