CVE-2026-63946: Bluetooth: ISO: fix UAF in iso_recv_frame
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: fix UAF in isorecvframe
isorecvframe reads conn->sk under isoconnlock but releases the lock before using sk, with no reference held. A concurrent isosockkill() can free sk in that window, causing use-after-free on sk->skstate and sockqueuercvskb().
Fix by replacing the bare pointer read with isosockhold(conn), which calls sockhold() while the spinlock is held, atomically elevating the refcount before the lock drops. Add a dropput label so sockput() is called on all exit paths where the hold succeeded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.94-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.0.12-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.176 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.143 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.93 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.35 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.0.12 - Compensating control
In Linux Bluetooth ISO iso_recv_frame, replace the bare conn->sk pointer read with iso_sock_hold(conn) while iso_conn_lock is held, and add a drop_put exit label so sock_put() is called on every exit path where the hold succeeds.
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
The race requires Bluetooth ISO frame reception to occur while a concurrent ISO socket teardown via iso_sock_kill() frees the associated socket. Exploitation does not require privileges or user interaction according to the supplied vector, and attack reachability is adjacent-network.
Which systems are exposed?
Affected systems are Linux kernel deployments using the Bluetooth ISO functionality. The provided data does not identify affected kernel versions, distributions, or whether Bluetooth ISO is enabled by default.
What is the impact if the race is triggered?
A socket pointer can be used after it has been freed when iso_recv_frame accesses the socket state or queues a received skb. The supplied severity vector rates confidentiality, integrity, and availability impact as high.
What does the fix change?
The fix obtains a socket reference with iso_sock_hold(conn) while iso_conn_lock is held, preventing the socket from being freed after the lock is released. It also ensures sock_put() releases that reference on every applicable exit path.