CVE-2026-63946: Linux Kernel Bluetooth Use-After-Free

CVE-2026-63946 Overview

CVE-2026-63946 is a use-after-free vulnerability in the Linux kernel Bluetooth Isochronous (ISO) subsystem. The flaw resides in the iso_recv_frame function, which reads conn->sk under iso_conn_lock but releases the lock before using sk, without holding a reference. A concurrent iso_sock_kill() call can free sk in this race window, causing use-after-free on sk->sk_state and sock_queue_rcv_skb(). The vulnerability is exploitable over the adjacent network via Bluetooth, requires no privileges, and no user interaction. Successful exploitation can lead to kernel memory corruption, information disclosure, or arbitrary code execution in kernel context.

Critical Impact
An attacker within Bluetooth range can trigger a race condition to corrupt kernel memory, potentially leading to arbitrary code execution or full system compromise.

Affected Products

Linux kernel Bluetooth ISO subsystem
Kernel branches referenced by upstream stable commits including 119fb6f8, 1a6b803b, 47f23a25, b04ec131, c318aa51, and c57ea90f
Linux distributions shipping vulnerable kernel versions prior to the stable patches

Discovery Timeline

2026-07-19 - CVE-2026-63946 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63946

Vulnerability Analysis

The defect is a classic use-after-free triggered by a race condition in the Bluetooth ISO receive path. iso_recv_frame acquires iso_conn_lock, reads the conn->sk pointer, and then releases the lock before dereferencing sk. Between lock release and dereference, another kernel thread executing iso_sock_kill() can free the socket structure. Subsequent access to sk->sk_state and the call to sock_queue_rcv_skb() then operate on freed memory. Kernel use-after-free primitives frequently allow attackers to place controlled data in the freed slab, enabling type confusion, function pointer hijacking, or privilege escalation.

Root Cause

The root cause is missing reference counting when moving from a locked pointer read to an unlocked dereference. Reading a pointer under a spinlock does not guarantee the referent remains valid after the lock drops. The upstream fix replaces the bare pointer read with iso_sock_hold(conn), which calls sock_hold() while the spinlock is still held. This atomically elevates the socket refcount before the lock is released. The patch also introduces a drop_put label so sock_put() is called on all exit paths where the hold succeeded.

Attack Vector

Exploitation requires proximity to the target within Bluetooth range and an established ISO connection. An adjacent attacker sends crafted ISO frames while simultaneously inducing socket teardown, racing iso_sock_kill() against iso_recv_frame. Winning the race yields a dangling sk pointer whose backing memory can be reallocated with attacker-influenced content through kernel heap spraying techniques. See the upstream patch Kernel Commit b04ec131 for the corrected code path.

Detection Methods for CVE-2026-63946

Indicators of Compromise

Kernel oops or panic entries in dmesg referencing iso_recv_frame, sock_queue_rcv_skb, or iso_sock_kill
KASAN reports flagging use-after-free in the Bluetooth ISO code path
Unexpected Bluetooth service crashes or bluetoothd restarts under active ISO connections
Anomalous adjacent Bluetooth activity involving repeated ISO channel setup and teardown

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test and staging systems to surface use-after-free conditions in the ISO stack
Monitor kernel ring buffer and journalctl -k output for oops signatures involving Bluetooth ISO symbols
Inventory hosts running vulnerable kernel builds by comparing installed kernel package versions against distribution advisories
Correlate Bluetooth interface state changes with kernel fault events in centralized logging

Monitoring Recommendations

Ship kernel logs to a SIEM and alert on BUG:, KASAN:, or general protection fault messages tied to iso_ symbols
Track Bluetooth radio activity on endpoints where the ISO profile is not required by business function
Baseline bluetoothd process behavior and alert on abnormal termination or restart loops

How to Mitigate CVE-2026-63946

Immediate Actions Required

Apply the latest stable kernel updates from your Linux distribution that incorporate the referenced upstream commits
Disable the Bluetooth subsystem on hosts that do not require it using rmmod bluetooth or blacklisting the module
Restrict Bluetooth discoverability and pairing on systems that must keep the stack enabled
Prioritize patching for laptops, workstations, and IoT devices exposed to untrusted physical environments

Patch Information

The fix is available in the upstream Linux stable tree via commits 119fb6f8, 1a6b803b, 47f23a25, b04ec131, c318aa51, and c57ea90f. Consult your distribution's security tracker for backported package versions.

Workarounds

Unload the Bluetooth kernel modules where the functionality is not required
Blacklist the bluetooth and related ISO modules in /etc/modprobe.d/ to prevent load at boot
Use hardware or firmware controls to disable Bluetooth radios on managed fleets until patches are deployed
Limit physical and RF proximity to critical systems by policy and physical security controls

bash

# Disable Bluetooth modules until patched kernel is installed
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/blacklist-bluetooth.conf
echo 'blacklist btusb' | sudo tee -a /etc/modprobe.d/blacklist-bluetooth.conf
sudo update-initramfs -u

# Verify patched kernel version after update
uname -r
apt list --installed 2>/dev/null | grep linux-image