CVE-2026-63946High· 8.8▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in iso_recv_frame iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock before using sk, with no reference held. A concurrent…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Last analysed / modified upstream
0.3% → 0.3%
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: fix UAF in iso_recv_frame
iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock before using sk, with no reference held. A concurrent iso_sock_kill() can free sk in that window, causing use-after-free on sk->sk_state and sock_queue_rcv_skb().
Fix by replacing the bare pointer read with iso_sock_hold(conn), which calls sock_hold() while the spinlock is held, atomically elevating the refcount before the lock drops. Add a drop_put label so sock_put() is called on all exit paths where the hold succeeded.
Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < c57ea90f203c8b8b41a474f19a09000d0f841436Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 119fb6f80c44dc1c65d604cf28e64c56bd9b6568Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < b04ec131325baf4ea4577d6c6e6b86cf092e3731Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < c318aa51830a3d2cc1229968fe521441c97356cdLinux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 1a6b803b00ccdd7666506adbe01ddae1c72d1ca9Linux >= ccf74f2390d60a2f9a75ef496d2564abb478f46a < 47f23a259517abbdb8032c057a1e8a6bf3734878Linux 6.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing
CVE-2026-99117Nonenet: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99121Noneipv4: avoid divide by zero in fib_rebalance
CVE-2026-99120NoneKVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
CVE-2026-99119Nonedrm/amdgpu/userq: actually validate userq BOs
CVE-2026-99123Nonevsock/virtio: validate packet source for connected sockets