CVE-2026-63871: Linux Kernel Race Condition Vulnerability

CVE-2026-63871 Overview

CVE-2026-63871 is a data-race vulnerability in the Linux kernel's Bluetooth Isochronous (ISO) subsystem. The flaw affects iso_connect_bis(), iso_connect_cis(), iso_listen_bis(), and iso_conn_big_sync(). These functions call hci_get_route() using iso_pi(sk)->dst, iso_pi(sk)->src, and iso_pi(sk)->src_type without holding lock_sock(). Concurrent modification of these fields by connect() or setsockopt() on the same socket produces data-races detected by the Kernel Concurrency Sanitizer (KCSAN). The upstream fix snapshots the required fields under lock_sock() before invoking hci_get_route().

Critical Impact
Concurrent socket operations on Bluetooth ISO sockets can trigger data-races in hci_get_route(), leading to unpredictable kernel behavior in the Bluetooth stack.

Affected Products

Linux kernel Bluetooth subsystem (ISO socket implementation)
Kernel versions prior to the commits referenced in the stable tree fixes
Distributions shipping the affected mainline Bluetooth ISO code paths

Discovery Timeline

2026-07-19 - CVE-2026-63871 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63871

Vulnerability Analysis

The Linux kernel Bluetooth ISO layer manages sockets that expose Broadcast Isochronous Streams (BIS) and Connected Isochronous Streams (CIS). Several code paths read the ISO protocol info fields directly from iso_pi(sk) without serializing access. Specifically, iso_connect_bis(), iso_connect_cis(), iso_listen_bis(), and iso_conn_big_sync() invoke hci_get_route() with iso_pi(sk)->dst, iso_pi(sk)->src, and iso_pi(sk)->src_type.

Userspace can concurrently mutate these fields through connect() and setsockopt() on the same socket. The result is a classic read/write data-race on shared socket state, which the KCSAN reporter identified during a call chain ending in memcmp inside hci_get_route(). This falls under Race Condition weaknesses, closely related to [CWE-362].

Root Cause

The root cause is missing socket-level locking. The affected callers dereference iso_pi(sk) fields without acquiring lock_sock(), while other paths mutate the same fields under proper locking. This asymmetry allows two threads operating on the same socket to observe or produce inconsistent values while hci_get_route() walks Bluetooth device state.

Attack Vector

Triggering the race requires local access to a Bluetooth ISO socket and the ability to issue concurrent connect() or setsockopt() calls. The reported KCSAN trace originates from the __x64_sys_connect syscall path: iso_sock_connect calls iso_connect_cis, which then calls hci_get_route, where memcmp reads a byte concurrently written elsewhere. There is no verified public exploit, and the observable effect is undefined behavior in the Bluetooth path rather than a documented memory corruption primitive.

No verified exploit code is available. Refer to the upstream commits for the exact source-level changes: Kernel Git Commit 859bb1f, Kernel Git Commit 9798f7d, Kernel Git Commit 9ca7053, and Kernel Git Commit ab84fd7.

Detection Methods for CVE-2026-63871

Indicators of Compromise

KCSAN reports referencing memcmp and hci_get_route in kernel logs
Bluetooth ISO socket call chains involving iso_connect_cis, iso_connect_bis, iso_listen_bis, or iso_conn_big_sync
Unexpected kernel warnings originating from the net/bluetooth/iso.c code path

Detection Strategies

Enable KCSAN on test kernels to surface data-races in the Bluetooth ISO code paths
Monitor dmesg and journal logs for Bluetooth-related warnings following concurrent socket operations
Track running kernel versions against the fixed stable commits listed in the upstream references

Monitoring Recommendations

Inventory hosts that expose Bluetooth ISO functionality, particularly audio and broadcast use cases
Alert on kernel version drift below patched stable releases across the fleet
Collect kernel crash and warning telemetry centrally to correlate Bluetooth stack anomalies

How to Mitigate CVE-2026-63871

Immediate Actions Required

Apply the stable kernel updates that include the referenced Bluetooth ISO fixes
Prioritize patching on systems that use Bluetooth LE Audio, BIS, or CIS features
Disable Bluetooth on systems that do not require it until patched kernels are deployed

Patch Information

The fix serializes access by snapshotting iso_pi(sk)->dst, iso_pi(sk)->src, and iso_pi(sk)->src_type under lock_sock() before calling hci_get_route(). The corrections are available in the stable tree at Kernel Git Commit 859bb1f, Kernel Git Commit 9798f7d, Kernel Git Commit 9ca7053, and Kernel Git Commit ab84fd7.

Workarounds

Unload the bluetooth kernel module on servers that do not require Bluetooth connectivity
Restrict local user access to Bluetooth sockets through host hardening and capability controls
Rebuild vendor kernels with the referenced ISO locking patches backported where distribution updates lag

bash

# Verify running kernel and disable Bluetooth where not required
uname -r
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
sudo modprobe -r bluetooth || true