{"id":"CVE-2026-63946","title":"Bluetooth: ISO: fix UAF in iso_recv_frame","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix UAF in iso_recv_frame\n\niso_recv_frame reads conn->sk under iso_conn_lock but releases the lock\nbefore using sk, with no reference held. A concurrent…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < c57ea90f203c8b8b41a474f19a09000d0f841436","Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 119fb6f80c44dc1c65d604cf28e64c56bd9b6568","Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < b04ec131325baf4ea4577d6c6e6b86cf092e3731","Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < c318aa51830a3d2cc1229968fe521441c97356cd","Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 1a6b803b00ccdd7666506adbe01ddae1c72d1ca9","Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 47f23a259517abbdb8032c057a1e8a6bf3734878","Linux 6.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:34:05.686988Z"},"published":"2026-07-19","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:42:14.203Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63946","references":[{"url":"https://git.kernel.org/stable/c/c57ea90f203c8b8b41a474f19a09000d0f841436"},{"url":"https://git.kernel.org/stable/c/119fb6f80c44dc1c65d604cf28e64c56bd9b6568"},{"url":"https://git.kernel.org/stable/c/b04ec131325baf4ea4577d6c6e6b86cf092e3731"},{"url":"https://git.kernel.org/stable/c/c318aa51830a3d2cc1229968fe521441c97356cd"},{"url":"https://git.kernel.org/stable/c/1a6b803b00ccdd7666506adbe01ddae1c72d1ca9"},{"url":"https://git.kernel.org/stable/c/47f23a259517abbdb8032c057a1e8a6bf3734878"}],"tags":["cve.org"],"epss":0.00336,"epssPercentile":0.2548,"ingestedAt":"2026-10-16T17:24:46.783Z","slug":"CVE-2026-63946","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix UAF in iso_recv_frame\n\niso_recv_frame reads conn->sk under iso_conn_lock but releases the lock\nbefore using sk, with no reference held. A concurrent iso_sock_kill()\ncan free sk in that window, causing use-after-free on sk->sk_state and\nsock_queue_rcv_skb().\n\nFix by replacing the bare pointer read with iso_sock_hold(conn), which\ncalls sock_hold() while the spinlock is held, atomically elevating the\nrefcount before the lock drops. Add a drop_put label so sock_put() is\ncalled on all exit paths where the hold succeeded.\n\n## Affected\n\n- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < c57ea90f203c8b8b41a474f19a09000d0f841436`\n- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 119fb6f80c44dc1c65d604cf28e64c56bd9b6568`\n- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < b04ec131325baf4ea4577d6c6e6b86cf092e3731`\n- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < c318aa51830a3d2cc1229968fe521441c97356cd`\n- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 1a6b803b00ccdd7666506adbe01ddae1c72d1ca9`\n- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 47f23a259517abbdb8032c057a1e8a6bf3734878`\n- `Linux 6.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}