PT-2026-61263 · Linux · Linux

CVE-2026-63946 · Publicado 2026-07-19 · Atualizado 2026-07-19

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: fix UAF in iso recv frame

iso recv frame reads conn->sk under iso conn lock but releases the lock before using sk, with no reference held. A concurrent iso sock kill() can free sk in that window, causing use-after-free on sk->sk state and sock queue rcv skb().

Fix by replacing the bare pointer read with iso sock hold(conn), which calls sock hold() while the spinlock is held, atomically elevating the refcount before the lock drops. Add a drop put label so sock put() is called on all exit paths where the hold succeeded.

Correção

Identificadores relacionados

CVE-2026-63946

Produtos afetados

Linux

Referências · 7

• https://git.kernel.org/stable/c/b04ec131325baf4ea4577d6c6e6b86cf092e3731 · Nota
• https://git.kernel.org/stable/c/c318aa51830a3d2cc1229968fe521441c97356cd · Nota
• https://git.kernel.org/stable/c/c57ea90f203c8b8b41a474f19a09000d0f841436 · Nota
• https://git.kernel.org/stable/c/1a6b803b00ccdd7666506adbe01ddae1c72d1ca9 · Nota
• https://git.kernel.org/stable/c/47f23a259517abbdb8032c057a1e8a6bf3734878 · Nota
• https://git.kernel.org/stable/c/119fb6f80c44dc1c65d604cf28e64c56bd9b6568 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63946 · Nota de Segurança