---
id: CVE-2026-63945
title: 'Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

  iso_sock_close() calls iso_sock_clear_timer() before acquiring
  lock_sock(sk).

  iso_sock_clear_timer() r…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    d9cbf7144ec589a3f0cc91f74a1a1af2d2b14afa
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    35f68f36d9883d56dec21cf85f7556d4657fc393
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    996c2104d0726a8fe584f85b3d6327197374a348
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    bc08c15746f25f41dd0508b25780d1e84acbb2ef
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    51cb9dcfdf9a1bccf312ab2ae4b62db629f7dcd5
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    4b5f8e608749b7e8fa386c6e4301cf9272595859
  - Linux 6.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:34:00.838268Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:14.039Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63945'
references:
  - url: 'https://git.kernel.org/stable/c/d9cbf7144ec589a3f0cc91f74a1a1af2d2b14afa'
  - url: 'https://git.kernel.org/stable/c/35f68f36d9883d56dec21cf85f7556d4657fc393'
  - url: 'https://git.kernel.org/stable/c/996c2104d0726a8fe584f85b3d6327197374a348'
  - url: 'https://git.kernel.org/stable/c/bc08c15746f25f41dd0508b25780d1e84acbb2ef'
  - url: 'https://git.kernel.org/stable/c/51cb9dcfdf9a1bccf312ab2ae4b62db629f7dcd5'
  - url: 'https://git.kernel.org/stable/c/4b5f8e608749b7e8fa386c6e4301cf9272595859'
tags:
  - cve.org
epss: 0.00164
epssPercentile: 0.0524
ingestedAt: '2026-10-16T17:24:46.783Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

iso_sock_close() calls iso_sock_clear_timer() before acquiring
lock_sock(sk).

iso_sock_clear_timer() reads iso_pi(sk)->conn twice without the
socket lock held:

    if (!iso_pi(sk)->conn)
        return;
    cancel_delayed_work(&iso_pi(sk)->conn->timeout_work);

Concurrently, iso_conn_del() executes under lock_sock(sk) and calls
iso_chan_del(), which sets iso_pi(sk)->conn to NULL and may result in
the final reference to the connection being dropped:

    CPU0                         CPU1
    ----                         ----
    iso_sock_clear_timer()
      if (conn != NULL) ...      lock_sock(sk)
                                   iso_chan_del()
                                   iso_pi(sk)->conn = NULL
      cancel_delayed_work(conn)  /* NULL deref or UAF */

iso_pi(sk)->conn is not stable across the unlock window, causing a
NULL pointer dereference or use-after-free.

Serialize iso_sock_clear_timer() with the socket lock by moving it
inside lock_sock()/release_sock(), matching the pattern used in
iso_conn_del() and all other call sites.

## Affected

- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < d9cbf7144ec589a3f0cc91f74a1a1af2d2b14afa`
- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 35f68f36d9883d56dec21cf85f7556d4657fc393`
- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 996c2104d0726a8fe584f85b3d6327197374a348`
- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < bc08c15746f25f41dd0508b25780d1e84acbb2ef`
- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 51cb9dcfdf9a1bccf312ab2ae4b62db629f7dcd5`
- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 4b5f8e608749b7e8fa386c6e4301cf9272595859`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.