CVE-2026-63945 Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
A race condition in the Linux kernel Bluetooth ISO subsystem allows attackers to cause a use-after-free or null dereference, potentially leading to system crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63945?
CVE-2026-63945 is a high-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
iso_sock_close() calls iso_sock_clear_timer() before acquiring lock_sock(sk).
iso_sock_clear_timer() reads iso_pi(sk)->conn twice without the socket lock held:
if (!iso_pi(sk)->conn) return; cancel_delayed_work(&iso_pi(sk)->conn->timeout_work);
Concurrently, iso_conn_del() executes under lock_sock(sk) and calls iso_chan_del(), which sets iso_pi(sk)->conn to NULL and may result in the final reference to the connection being dropped:
CPU0 CPU1 ---- ---- iso_sock_clear_timer() if (conn != NULL) ... lock_sock(sk) iso_chan_del() iso_pi(sk)->conn = NULL cancel_delayed_work(conn) /* NULL deref or UAF */
iso_pi(sk)->conn is not stable across the unlock window, causing a NULL pointer dereference or use-after-free.
Serialize iso_sock_clear_timer() with the socket lock by moving it inside lock_sock()/release_sock(), matching the pattern used in iso_conn_del() and all other call sites.
Weakness: CWE-362
Which versions are affected by CVE-2026-63945?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-63945?
Apply the vendor's patch.
Is CVE-2026-63945 being exploited?
There is no known exploitation of CVE-2026-63945 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-63945, DEBIAN-CVE-2026-63945, GHSA-85m8-5mhx-q797, UBUNTU-CVE-2026-63945.