CVE-2026-63945: Linux Kernel Bluetooth Use-After-Free

CVE-2026-63945 Overview

CVE-2026-63945 is a race condition vulnerability in the Linux kernel's Bluetooth Isochronous (ISO) socket implementation. The flaw exists in iso_sock_close(), which invokes iso_sock_clear_timer() before acquiring the socket lock via lock_sock(sk). This unlocked access allows a concurrent thread executing iso_conn_del() to set iso_pi(sk)->conn to NULL and drop the final connection reference between the pointer check and its dereference. The resulting condition produces either a NULL pointer dereference or a use-after-free (UAF) in kernel context.

Critical Impact
A local attacker with the ability to open Bluetooth ISO sockets can trigger a NULL pointer dereference or use-after-free in the Linux kernel, leading to system crash or potential local privilege escalation.

Affected Products

Linux Kernel — Bluetooth subsystem (ISO socket handling)
Distributions shipping vulnerable kernel versions prior to the referenced upstream fixes
Systems with Bluetooth ISO (BLE Audio / LE Isochronous Channels) support enabled

Discovery Timeline

2026-07-19 - CVE-2026-63945 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63945

Vulnerability Analysis

The defect resides in the Bluetooth ISO socket close path. When iso_sock_close() runs, it calls iso_sock_clear_timer() prior to taking the per-socket lock. Inside iso_sock_clear_timer(), the code reads iso_pi(sk)->conn twice: once to test for NULL and again to dereference &iso_pi(sk)->conn->timeout_work when calling cancel_delayed_work(). Without the socket lock held, this two-step access is not atomic.

Concurrently, another CPU can execute iso_conn_del() under lock_sock(sk). That path calls iso_chan_del(), which nulls out iso_pi(sk)->conn and may drop the final reference to the connection object. If the timing window is hit, the first thread observes a non-NULL pointer, then dereferences memory that has been zeroed or freed.

The upstream fix moves the iso_sock_clear_timer() call inside the lock_sock()/release_sock() critical section, aligning it with the locking discipline used by iso_conn_del() and other call sites.

Root Cause

The root cause is a race condition [CWE-362] between an unlocked read of iso_pi(sk)->conn and a concurrent write under the socket lock. Kernel invariants require access to iso_pi(sk)->conn be serialized by the socket lock, but the close path violated this contract, producing a TOCTOU-style window that resolves to either a NULL pointer dereference or a use-after-free.

Attack Vector

Exploitation requires local access and the ability to open and close Bluetooth ISO sockets. An unprivileged local user can script concurrent open/close operations on ISO sockets to race the close path against connection teardown. Successful races trigger kernel memory corruption. Depending on the freed object layout and heap grooming, an attacker may escalate from a denial of service to arbitrary kernel code execution.

No public proof-of-concept exploit or exploitation in the wild has been reported at time of publication. The vulnerability requires that the target system has the Bluetooth ISO subsystem enabled and reachable from user space.

Detection Methods for CVE-2026-63945

Indicators of Compromise

Kernel oops or panic messages referencing iso_sock_clear_timer, cancel_delayed_work, or iso_pi in the call trace
KASAN reports flagging use-after-free reads in the net/bluetooth/iso.c code path
Unexpected BUG: kernel NULL pointer dereference entries in dmesg on systems with active Bluetooth ISO usage

Detection Strategies

Monitor kernel ring buffer and journalctl -k output for oops signatures involving the Bluetooth ISO subsystem
Deploy KASAN-enabled kernels in test environments to surface latent UAF conditions in net/bluetooth/iso.c
Audit installed kernel package versions against distribution advisories referencing the upstream commits 35f68f36, 4b5f8e60, 51cb9dcf, 996c2104, bc08c157, and d9cbf714

Monitoring Recommendations

Alert on repeated kernel crashes or reboots on hosts with active Bluetooth stacks, particularly on endpoints, workstations, and embedded Linux devices
Correlate crash telemetry with local process activity that opens AF_BLUETOOTH sockets with BTPROTO_ISO
Track kernel package inventory and pending reboots across the fleet to identify hosts still running unpatched kernels

How to Mitigate CVE-2026-63945

Immediate Actions Required

Apply vendor-supplied kernel updates that include the upstream Bluetooth ISO locking fix as soon as they are available
Reboot affected systems after patch installation to load the corrected kernel image
On systems that do not require Bluetooth ISO, disable the Bluetooth stack or block loading of the bluetooth and related modules to remove the attack surface

Patch Information

The fix has been merged into the upstream Linux kernel across multiple stable branches. Refer to the following commits for the corrected locking behavior: Kernel Git Commit 35f68f3, Kernel Git Commit 4b5f8e6, Kernel Git Commit 51cb9dc, Kernel Git Commit 996c210, Kernel Git Commit bc08c15, and Kernel Git Commit d9cbf71. Consult your Linux distribution's security advisory portal for backported package versions.

Workarounds

Blacklist the bluetooth kernel module on systems that do not require Bluetooth functionality to eliminate exposure
Restrict local user access on multi-user systems and remove CAP_NET_RAW where not required to reduce the population of users able to open ISO sockets
Disable Bluetooth radios via rfkill block bluetooth on servers and workstations where the feature is not in operational use

bash

# Blacklist the Bluetooth module and disable the radio
echo "blacklist bluetooth" | sudo tee /etc/modprobe.d/disable-bluetooth.conf
sudo rfkill block bluetooth
sudo systemctl disable --now bluetooth.service