CVE-2026-63945High· 7.8▾ Twilight

Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock iso_sock_close() calls iso_sock_clear_timer() before acquiring lock_sock(sk). iso_sock_clear_timer() r…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 19, 2026

Updated

Oct 19, 2026

CVSS

7.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

43 · Moderate

EPSS

0.13% · p2

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-16

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 16.

0.2% → 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 92 days

Jul 19, 2026Published
Disclosed via CVEORG
Oct 16, 2026EPSS first tracked
0.2%
Oct 19, 2026Record revised
Last analysed / modified upstream

Linux #cve.org

Affected

Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < d9cbf7144ec589a3f0cc91f74a1a1af2d2b14afa
Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 35f68f36d9883d56dec21cf85f7556d4657fc393
Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 996c2104d0726a8fe584f85b3d6327197374a348
Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < bc08c15746f25f41dd0508b25780d1e84acbb2ef
Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 51cb9dcfdf9a1bccf312ab2ae4b62db629f7dcd5
Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 4b5f8e608749b7e8fa386c6e4301cf9272595859
Linux 6.0

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

iso_sock_close() calls iso_sock_clear_timer() before acquiring lock_sock(sk).

iso_sock_clear_timer() reads iso_pi(sk)->conn twice without the socket lock held:

if (!iso_pi(sk)->conn)
    return;
cancel_delayed_work(&iso_pi(sk)->conn->timeout_work);

Concurrently, iso_conn_del() executes under lock_sock(sk) and calls iso_chan_del(), which sets iso_pi(sk)->conn to NULL and may result in the final reference to the connection being dropped:

CPU0                         CPU1
----                         ----
iso_sock_clear_timer()
  if (conn != NULL) ...      lock_sock(sk)
                               iso_chan_del()
                               iso_pi(sk)->conn = NULL
  cancel_delayed_work(conn)  /* NULL deref or UAF */

iso_pi(sk)->conn is not stable across the unlock window, causing a NULL pointer dereference or use-after-free.

Serialize iso_sock_clear_timer() with the socket lock by moving it inside lock_sock()/release_sock(), matching the pattern used in iso_conn_del() and all other call sites.

Affected

Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < d9cbf7144ec589a3f0cc91f74a1a1af2d2b14afa
Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 35f68f36d9883d56dec21cf85f7556d4657fc393
Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 996c2104d0726a8fe584f85b3d6327197374a348
Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < bc08c15746f25f41dd0508b25780d1e84acbb2ef
Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 51cb9dcfdf9a1bccf312ab2ae4b62db629f7dcd5
Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 4b5f8e608749b7e8fa386c6e4301cf9272595859
Linux 6.0

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

iso_sock_close() calls iso_sock_clear_timer() before acquiring lock_sock(sk).

iso_sock_clear_timer() reads iso_pi(sk)->conn twice without the socket lock held:

if (!iso_pi(sk)->conn) return; cancel_delayed_work(&iso_pi(sk)->conn->timeout_work);

Concurrently, iso_conn_del() executes under lock_sock(sk) and calls iso_chan_del(), which sets iso_pi(sk)->conn to NULL and may result in the final reference to the connection being dropped:

CPU0 CPU1 ---- ---- iso_sock_clear_timer() if (conn != NULL) ... lock_sock(sk) iso_chan_del() iso_pi(sk)->conn = NULL cancel_delayed_work(conn) /* NULL deref or UAF */

iso_pi(sk)->conn is not stable across the unlock window, causing a NULL pointer dereference or use-after-free.

Serialize iso_sock_clear_timer() with the socket lock by moving it inside lock_sock()/release_sock(), matching the pattern used in iso_conn_del() and all other call sites.

Affected

Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < d9cbf7144ec589a3f0cc91f74a1a1af2d2b14afa

Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 35f68f36d9883d56dec21cf85f7556d4657fc393

Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 996c2104d0726a8fe584f85b3d6327197374a348

Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < bc08c15746f25f41dd0508b25780d1e84acbb2ef

Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 51cb9dcfdf9a1bccf312ab2ae4b62db629f7dcd5

Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 4b5f8e608749b7e8fa386c6e4301cf9272595859

Linux 6.0