PT-2026-61263 · Linux · Linux

CVE-2026-63946 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: fix UAF in iso recv frame

iso recv frame reads conn->sk under iso conn lock but releases the lock before using sk, with no reference held. A concurrent iso sock kill() can free sk in that window, causing use-after-free on sk->sk state and sock queue rcv skb().

Fix by replacing the bare pointer read with iso sock hold(conn), which calls sock hold() while the spinlock is held, atomically elevating the refcount before the lock drops. Add a drop put label so sock put() is called on all exit paths where the hold succeeded.

Fix

Related Identifiers

CVE-2026-63946

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-63946 · Security Note
• https://git.kernel.org/stable/c/b04ec131325baf4ea4577d6c6e6b86cf092e3731 · Note
• https://git.kernel.org/stable/c/c318aa51830a3d2cc1229968fe521441c97356cd · Note
• https://git.kernel.org/stable/c/c57ea90f203c8b8b41a474f19a09000d0f841436 · Note
• https://git.kernel.org/stable/c/1a6b803b00ccdd7666506adbe01ddae1c72d1ca9 · Note
• https://git.kernel.org/stable/c/47f23a259517abbdb8032c057a1e8a6bf3734878 · Note
• https://git.kernel.org/stable/c/119fb6f80c44dc1c65d604cf28e64c56bd9b6568 · Note