{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63945","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T07:54:57.022Z","datePublished":"2026-07-19T14:55:39.859Z","dateUpdated":"2026-08-05T12:37:32.019Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:37:32.019Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: serialize iso_sock_clear_timer with socket lock\n\niso_sock_close() calls iso_sock_clear_timer() before acquiring\nlock_sock(sk).\n\niso_sock_clear_timer() reads iso_pi(sk)->conn twice without the\nsocket lock held:\n\n    if (!iso_pi(sk)->conn)\n        return;\n    cancel_delayed_work(&iso_pi(sk)->conn->timeout_work);\n\nConcurrently, iso_conn_del() executes under lock_sock(sk) and calls\niso_chan_del(), which sets iso_pi(sk)->conn to NULL and may result in\nthe final reference to the connection being dropped:\n\n    CPU0                         CPU1\n    ----                         ----\n    iso_sock_clear_timer()\n      if (conn != NULL) ...      lock_sock(sk)\n                                   iso_chan_del()\n                                   iso_pi(sk)->conn = NULL\n      cancel_delayed_work(conn)  /* NULL deref or UAF */\n\niso_pi(sk)->conn is not stable across the unlock window, causing a\nNULL pointer dereference or use-after-free.\n\nSerialize iso_sock_clear_timer() with the socket lock by moving it\ninside lock_sock()/release_sock(), matching the pattern used in\niso_conn_del() and all other call sites."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The buggy path is exclusively `iso_sock_close()` calling `iso_sock_clear_timer()` without the socket lock, reachable only via local socket teardown (`close()`/`release()` on `BTPROTO_ISO`). The concurrent `iso_conn_del()` leg can be driven by adjacent Bluetooth HCI disconnect events, but adjacent access alone cannot reach the unlocked call site.\nAC:L - The attacker controls both sides of the race: a local thread can close the ISO socket while concurrently triggering or awaiting an HCI disconnect (locally initiated or from an adjacent Bluetooth peer), and can repeat the attempt until the window is hit.\nPR:L - Creating and closing `AF_BLUETOOTH`/`BTPROTO_ISO` sockets requires no kernel capabilities (`iso_sock_create()` has no `CAP_*` check); any unprivileged local process in the initial network namespace with Bluetooth access can reach the vulnerable code.\nUI:N - Exploitation does not require victim interaction when the attacker runs local code that opens an ISO socket and deliberately races `close()` against a Bluetooth disconnect; no pairing prompt or user action beyond attacker-controlled setup is needed.\nS:U - Impact is confined to kernel memory corruption and crash/privilege-escalation primitives within the same kernel security authority; there is no VM, sandbox, or IOMMU boundary crossing.\nC:H - The commit documents both NULL pointer dereference and use-after-free on `iso_conn`; UAF on a freed `iso_conn` structure gives attacker-influenced access to kernel heap memory and can be leveraged for information disclosure.\nI:H - Use-after-free on `iso_conn` via `cancel_delayed_work(&conn->timeout_work)` on freed memory is heap corruption with a function-pointer-bearing work struct, enabling spray-based arbitrary write and potential control-flow hijacking.\nA:H - The race produces kernel NULL dereference or use-after-free in softirq/workqueue context, which can oops or panic the host; UAF in connection teardown is independently availability-impacting even before full exploitation."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/iso.c"],"versions":[{"version":"ccf74f2390d60a2f9a75ef496d2564abb478f46a","lessThan":"d9cbf7144ec589a3f0cc91f74a1a1af2d2b14afa","status":"affected","versionType":"git"},{"version":"ccf74f2390d60a2f9a75ef496d2564abb478f46a","lessThan":"35f68f36d9883d56dec21cf85f7556d4657fc393","status":"affected","versionType":"git"},{"version":"ccf74f2390d60a2f9a75ef496d2564abb478f46a","lessThan":"996c2104d0726a8fe584f85b3d6327197374a348","status":"affected","versionType":"git"},{"version":"ccf74f2390d60a2f9a75ef496d2564abb478f46a","lessThan":"bc08c15746f25f41dd0508b25780d1e84acbb2ef","status":"affected","versionType":"git"},{"version":"ccf74f2390d60a2f9a75ef496d2564abb478f46a","lessThan":"51cb9dcfdf9a1bccf312ab2ae4b62db629f7dcd5","status":"affected","versionType":"git"},{"version":"ccf74f2390d60a2f9a75ef496d2564abb478f46a","lessThan":"4b5f8e608749b7e8fa386c6e4301cf9272595859","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/iso.c"],"versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","status":"unaffected","versionType":"semver"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.12.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.18.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"7.0.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/d9cbf7144ec589a3f0cc91f74a1a1af2d2b14afa"},{"url":"https://git.kernel.org/stable/c/35f68f36d9883d56dec21cf85f7556d4657fc393"},{"url":"https://git.kernel.org/stable/c/996c2104d0726a8fe584f85b3d6327197374a348"},{"url":"https://git.kernel.org/stable/c/bc08c15746f25f41dd0508b25780d1e84acbb2ef"},{"url":"https://git.kernel.org/stable/c/51cb9dcfdf9a1bccf312ab2ae4b62db629f7dcd5"},{"url":"https://git.kernel.org/stable/c/4b5f8e608749b7e8fa386c6e4301cf9272595859"}],"title":"Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock","x_generator":{"engine":"bippy-1.2.0"}}}}