PT-2026-61262 · Linux · Linux
CVE-2026-63945
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: serialize iso sock clear timer with socket lock
iso sock close() calls iso sock clear timer() before acquiring
lock sock(sk).
iso sock clear timer() reads iso pi(sk)->conn twice without the
socket lock held:
if (!iso pi(sk)->conn)
return;
cancel delayed work(&iso pi(sk)->conn->timeout work);
Concurrently, iso conn del() executes under lock sock(sk) and calls
iso chan del(), which sets iso pi(sk)->conn to NULL and may result in
the final reference to the connection being dropped:
CPU0 CPU1
iso sock clear timer()
if (conn != NULL) ... lock sock(sk)
iso chan del()
iso pi(sk)->conn = NULL
cancel delayed work(conn) /* NULL deref or UAF */
iso pi(sk)->conn is not stable across the unlock window, causing a
NULL pointer dereference or use-after-free.
Serialize iso sock clear timer() with the socket lock by moving it
inside lock sock()/release sock(), matching the pattern used in
iso conn del() and all other call sites.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux