PT-2026-61188 · Linux · Linux Kernel

CVE-2026-63871 · Published 2026-07-19 · Updated 2026-07-20

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A data-race exists in the Bluetooth ISO implementation. The functions iso connect bis(), iso connect cis(), iso listen bis(), and iso conn big sync() call hci get route() using the dst, src, and src type fields of iso pi(sk) without holding the lock sock() lock. These fields can be modified concurrently by connect() or setsockopt() on the same socket, leading to a data-race. A data-race is a condition where multiple threads access shared memory concurrently, and at least one access is a write, potentially causing unpredictable behavior.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-63871

Affected Products

Linux Kernel

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-63871 · Security Note
• https://git.kernel.org/stable/c/9ca7053d6215d89c33f28893bfd1625a32919d3f · Note
• https://twitter.com/windowsforum/status/2079126952934322609 · Twitter Post
• https://git.kernel.org/stable/c/ab84fd7779a2a7ff5d2c8eac212c43733f56216e · Note
• https://git.kernel.org/stable/c/859bb1f4cb615d98c9c1ab2bd76ebb0b8fe46020 · Note
• https://git.kernel.org/stable/c/9798f7d41d85ff763afd1f1cc0533b5c416c8348 · Note