CVE-2026-63944: Linux Kernel Bluetooth UAF Vulnerability

CVE-2026-63944 Overview

CVE-2026-63944 is a use-after-free (UAF) vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the hci_le_create_cis_sync() function within hci_sync.c. The function dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). A concurrent disconnect can free the hci_conn structure between the unlock and the dereference, producing a use-after-free read. The flaw was identified using 0sec.ai, an open-source automated security auditing platform. Multiple stable kernel branches received fixes referenced by commits 380e67b, a55618c, a921957, bfea609, and d901921.

Critical Impact
A local attacker within Bluetooth range can trigger memory corruption in the kernel, potentially leading to privilege escalation, kernel information disclosure, or denial of service.

Affected Products

Linux kernel Bluetooth subsystem (net/bluetooth/hci_sync.c)
Multiple stable Linux kernel branches referenced by the upstream fix commits
Distributions shipping the affected mainline Bluetooth code prior to backport

Discovery Timeline

2026-07-19 - CVE-2026-63944 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63944

Vulnerability Analysis

The defect lives in hci_le_create_cis_sync(), which iterates over hdev->conn_hash.list under RCU protection to locate a pending Connected Isochronous Stream (CIS) connection. After finding the target hci_conn, the function releases rcu_read_lock() and hci_dev_lock(hdev) before dereferencing conn->conn_timeout. Once the locks are dropped, the RCU guarantees against concurrent free no longer apply, and a parallel disconnect path can free the hci_conn object.

The standard mitigation for this pattern is hci_cmd_sync_dequeue(), which cancels pending work items during hci_conn_del(). However, the cancellation fails to match here. hci_le_create_cis_pending() queues the work with data=NULL:

hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL);

While hci_conn_del() attempts to dequeue with data=conn. Because _hci_cmd_sync_lookup_entry() compares these pointers directly, the lookup never matches and the pending work item continues to run against a freed connection.

Root Cause

The root cause is a lifetime mismatch between an RCU-protected pointer and its use after lock release [CWE-416]. The fix, mirroring commit 035c25007c9e ("Bluetooth: hci_sync: Fix UAF on le_read_features_complete"), saves conn->conn_timeout into a local variable while both locks are still held. This ensures the stale conn pointer is never dereferenced after unlock.

Attack Vector

Exploitation requires adjacent-network access via Bluetooth to trigger CIS connection setup and a race with a concurrent disconnect. An attacker with the ability to establish and tear down Bluetooth LE connections against a target host can attempt to win the race window between the RCU/hci_dev_lock release and the conn_timeout dereference. Successful races corrupt kernel memory and may be chained toward privilege escalation.

No public proof-of-concept is available. Refer to the upstream fix commits for the exact patched code paths.

Detection Methods for CVE-2026-63944

Indicators of Compromise

Unexpected kernel oops or panic messages referencing hci_le_create_cis_sync, hci_sync, or hci_conn_del in dmesg or /var/log/kern.log.
KASAN (Kernel Address Sanitizer) reports flagging use-after-free reads inside the Bluetooth HCI subsystem.
Repeated Bluetooth LE CIS connection attempts followed by rapid disconnects from an untrusted peer device.

Detection Strategies

Enable KASAN on test and canary hosts to surface UAF conditions in hci_sync.c before they crash production systems.
Monitor kernel ring buffer output for stack traces containing hci_le_create_cis_sync combined with slab or RCU warnings.
Correlate Bluetooth pairing and disconnect events with kernel crash telemetry to identify targeted race attempts.

Monitoring Recommendations

Ingest /var/log/kern.log and journalctl -k output into a centralized log platform and alert on Bluetooth-subsystem oops signatures.
Track Bluetooth adapter state changes and CIS setup failures on endpoints in high-risk environments such as conference rooms and executive travel devices.
Baseline expected Bluetooth peer counts and alert on abnormal churn indicative of race-condition probing.

How to Mitigate CVE-2026-63944

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 380e67b1794a, a55618c0f4ce, a921957d3929, bfea6091e0ff, and d9019210c8c3 or install the vendor kernel update containing these fixes.
On systems that do not require Bluetooth, disable the bluetooth kernel module using modprobe -r bluetooth and blacklist it to eliminate the attack surface.
Restrict Bluetooth pairing on production and executive endpoints until patched kernels are deployed.

Patch Information

The fix stores conn->conn_timeout in a local variable while rcu_read_lock() and hci_dev_lock(hdev) are still held, avoiding any post-unlock dereference of the RCU-protected hci_conn. The change is present in the following stable-tree commits: Kernel Git Commit 380e67b, Kernel Git Commit a55618c, Kernel Git Commit a921957, Kernel Git Commit bfea609, and Kernel Git Commit d901921. Rebuild and reboot into the patched kernel.

Workarounds

Disable the Bluetooth service (systemctl disable --now bluetooth) on servers and workstations that do not require it.
Unload and blacklist the bluetooth, btusb, and related kernel modules where Bluetooth functionality is unnecessary.
Physically disable Bluetooth radios in BIOS/UEFI on systems where the feature is not used, removing the adjacent-network attack surface entirely.

bash

# Disable and blacklist the Bluetooth stack until the patched kernel is deployed
sudo systemctl disable --now bluetooth
sudo modprobe -r btusb bluetooth
echo -e "blacklist bluetooth\nblacklist btusb" | \
  sudo tee /etc/modprobe.d/disable-bluetooth.conf
sudo update-initramfs -u