CVE-2026-63944

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free read occurs in the Bluetooth subsystem within the hci le create cis sync() function. The issue arises when the function dereferences the conn->conn timeout variable after releasing the rcu read lock() and hci dev lock(hdev) locks. Because the conn pointer is obtained via an RCU-protected iteration, it becomes invalid once the locks are dropped. A concurrent disconnect can free the hci conn object before the dereference occurs. The existing cancellation mechanism in hci conn del() fails to prevent this because hci le create cis pending() queues the work item with a NULL data pointer, while hci conn del() attempts to dequeue using the conn pointer, resulting in a mismatch during the lookup in hci cmd sync lookup entry().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.