---
id: CVE-2026-63946
title: 'Bluetooth: ISO: fix UAF in iso_recv_frame'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: ISO: fix UAF in iso_recv_frame

  iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock
  before using sk, with no reference held. A concurrent…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    c57ea90f203c8b8b41a474f19a09000d0f841436
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    119fb6f80c44dc1c65d604cf28e64c56bd9b6568
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    b04ec131325baf4ea4577d6c6e6b86cf092e3731
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    c318aa51830a3d2cc1229968fe521441c97356cd
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    1a6b803b00ccdd7666506adbe01ddae1c72d1ca9
  - >-
    Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a <
    47f23a259517abbdb8032c057a1e8a6bf3734878
  - Linux 6.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:34:05.686988Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:14.203Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63946'
references:
  - url: 'https://git.kernel.org/stable/c/c57ea90f203c8b8b41a474f19a09000d0f841436'
  - url: 'https://git.kernel.org/stable/c/119fb6f80c44dc1c65d604cf28e64c56bd9b6568'
  - url: 'https://git.kernel.org/stable/c/b04ec131325baf4ea4577d6c6e6b86cf092e3731'
  - url: 'https://git.kernel.org/stable/c/c318aa51830a3d2cc1229968fe521441c97356cd'
  - url: 'https://git.kernel.org/stable/c/1a6b803b00ccdd7666506adbe01ddae1c72d1ca9'
  - url: 'https://git.kernel.org/stable/c/47f23a259517abbdb8032c057a1e8a6bf3734878'
tags:
  - cve.org
epss: 0.00336
epssPercentile: 0.25457
ingestedAt: '2026-10-16T17:24:46.783Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: fix UAF in iso_recv_frame

iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock
before using sk, with no reference held. A concurrent iso_sock_kill()
can free sk in that window, causing use-after-free on sk->sk_state and
sock_queue_rcv_skb().

Fix by replacing the bare pointer read with iso_sock_hold(conn), which
calls sock_hold() while the spinlock is held, atomically elevating the
refcount before the lock drops. Add a drop_put label so sock_put() is
called on all exit paths where the hold succeeded.

## Affected

- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < c57ea90f203c8b8b41a474f19a09000d0f841436`
- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 119fb6f80c44dc1c65d604cf28e64c56bd9b6568`
- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < b04ec131325baf4ea4577d6c6e6b86cf092e3731`
- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < c318aa51830a3d2cc1229968fe521441c97356cd`
- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 1a6b803b00ccdd7666506adbe01ddae1c72d1ca9`
- `Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 47f23a259517abbdb8032c057a1e8a6bf3734878`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.