CVE-2026-63946 (GCVE-0-2026-63946)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
Title
Bluetooth: ISO: fix UAF in iso_recv_frame
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in iso_recv_frame iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock before using sk, with no reference held. A concurrent iso_sock_kill() can free sk in that window, causing use-after-free on sk->sk_state and sock_queue_rcv_skb(). Fix by replacing the bare pointer read with iso_sock_hold(conn), which calls sock_hold() while the spinlock is held, atomically elevating the refcount before the lock drops. Add a drop_put label so sock_put() is called on all exit paths where the hold succeeded.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < c57ea90f203c8b8b41a474f19a09000d0f841436 (git)
Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < 119fb6f80c44dc1c65d604cf28e64c56bd9b6568 (git)
Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < b04ec131325baf4ea4577d6c6e6b86cf092e3731 (git)
Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < c318aa51830a3d2cc1229968fe521441c97356cd (git)
Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < 1a6b803b00ccdd7666506adbe01ddae1c72d1ca9 (git)
Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < 47f23a259517abbdb8032c057a1e8a6bf3734878 (git)
Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c57ea90f203c8b8b41a474f19a09000d0f841436",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            },
            {
              "lessThan": "119fb6f80c44dc1c65d604cf28e64c56bd9b6568",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            },
            {
              "lessThan": "b04ec131325baf4ea4577d6c6e6b86cf092e3731",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            },
            {
              "lessThan": "c318aa51830a3d2cc1229968fe521441c97356cd",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            },
            {
              "lessThan": "1a6b803b00ccdd7666506adbe01ddae1c72d1ca9",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            },
            {
              "lessThan": "47f23a259517abbdb8032c057a1e8a6bf3734878",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix UAF in iso_recv_frame\n\niso_recv_frame reads conn-\u003esk under iso_conn_lock but releases the lock\nbefore using sk, with no reference held. A concurrent iso_sock_kill()\ncan free sk in that window, causing use-after-free on sk-\u003esk_state and\nsock_queue_rcv_skb().\n\nFix by replacing the bare pointer read with iso_sock_hold(conn), which\ncalls sock_hold() while the spinlock is held, atomically elevating the\nrefcount before the lock drops. Add a drop_put label so sock_put() is\ncalled on all exit paths where the hold succeeded."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is reached when the kernel processes inbound Bluetooth LE ISO data (HCI_ISODATA_PKT) from a remote peer over the radio; per kernel guidance Bluetooth is Adjacent, not Network.\nAC:L - An attacker can reliably win the race by flooding ISO frames while concurrently closing the ISO socket (or inducing disconnect that triggers stack teardown), controlling both the receive path and the iso_sock_kill() teardown path.\nPR:N - Exploitation requires only an established ISO connection with a malicious adjacent Bluetooth device; the vulnerable receive path needs no local privileges, and socket teardown can occur automatically when the remote peer disconnects.\nUI:N - No victim interaction is required during exploitation; ISO socket closure on disconnect is handled automatically by the Bluetooth stack and userspace daemons without user action.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The use-after-free dereferences freed struct sock memory (sk-\u003esk_state) after iso_sock_kill() can sock_put() the socket, enabling arbitrary kernel memory read primitives via heap reuse.\nI:H - The UAF continues into sock_queue_rcv_skb() on the freed socket, corrupting socket receive-queue state and enabling heap-based write/control-flow hijack primitives typical of kernel UAF bugs.\nA:H - Use-after-free on struct sock during receive processing can cause kernel oops/panic from invalid memory access, and UAF bugs in the kernel are rated High availability impact even when not fully weaponized."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:33.099Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c57ea90f203c8b8b41a474f19a09000d0f841436"
        },
        {
          "url": "https://git.kernel.org/stable/c/119fb6f80c44dc1c65d604cf28e64c56bd9b6568"
        },
        {
          "url": "https://git.kernel.org/stable/c/b04ec131325baf4ea4577d6c6e6b86cf092e3731"
        },
        {
          "url": "https://git.kernel.org/stable/c/c318aa51830a3d2cc1229968fe521441c97356cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a6b803b00ccdd7666506adbe01ddae1c72d1ca9"
        },
        {
          "url": "https://git.kernel.org/stable/c/47f23a259517abbdb8032c057a1e8a6bf3734878"
        }
      ],
      "title": "Bluetooth: ISO: fix UAF in iso_recv_frame",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63946",
    "datePublished": "2026-07-19T14:55:40.577Z",
    "dateReserved": "2026-07-19T07:54:57.023Z",
    "dateUpdated": "2026-08-05T12:37:33.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63946",
      "date": "2026-08-10",
      "epss": "0.00327",
      "percentile": "0.25274"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63946\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:13.223\",\"lastModified\":\"2026-07-27T17:44:23.777\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: ISO: fix UAF in iso_recv_frame\\n\\niso_recv_frame reads conn-\u003esk under iso_conn_lock but releases the lock\\nbefore using sk, with no reference held. A concurrent iso_sock_kill()\\ncan free sk in that window, causing use-after-free on sk-\u003esk_state and\\nsock_queue_rcv_skb().\\n\\nFix by replacing the bare pointer read with iso_sock_hold(conn), which\\ncalls sock_hold() while the spinlock is held, atomically elevating the\\nrefcount before the lock drops. Add a drop_put label so sock_put() is\\ncalled on all exit paths where the hold succeeded.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/iso.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ccf74f2390d60a2f9a75ef496d2564abb478f46a\",\"lessThan\":\"c57ea90f203c8b8b41a474f19a09000d0f841436\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ccf74f2390d60a2f9a75ef496d2564abb478f46a\",\"lessThan\":\"119fb6f80c44dc1c65d604cf28e64c56bd9b6568\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ccf74f2390d60a2f9a75ef496d2564abb478f46a\",\"lessThan\":\"b04ec131325baf4ea4577d6c6e6b86cf092e3731\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ccf74f2390d60a2f9a75ef496d2564abb478f46a\",\"lessThan\":\"c318aa51830a3d2cc1229968fe521441c97356cd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ccf74f2390d60a2f9a75ef496d2564abb478f46a\",\"lessThan\":\"1a6b803b00ccdd7666506adbe01ddae1c72d1ca9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ccf74f2390d60a2f9a75ef496d2564abb478f46a\",\"lessThan\":\"47f23a259517abbdb8032c057a1e8a6bf3734878\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/iso.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.143\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.93\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.35\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/119fb6f80c44dc1c65d604cf28e64c56bd9b6568\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1a6b803b00ccdd7666506adbe01ddae1c72d1ca9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/47f23a259517abbdb8032c057a1e8a6bf3734878\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b04ec131325baf4ea4577d6c6e6b86cf092e3731\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c318aa51830a3d2cc1229968fe521441c97356cd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c57ea90f203c8b8b41a474f19a09000d0f841436\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:20:44+00:00",
      "cve": "CVE-2026-63946",
      "id": "CVE-2026-63946",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: ISO: fix UAF in iso_recv_frame",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63946.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-10T16:25:01Z",
      "cve": "CVE-2026-63946",
      "id": "CVE-2026-63946",
      "initial_release_date": "2026-07-21T13:02:59Z",
      "product_status:first_fixed": "197",
      "product_status:known_affected": "78",
      "product_status:known_not_affected": "220",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63946",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63946.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.