CVE-2026-63945

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the Bluetooth ISO implementation where iso sock close() calls iso sock clear timer() before acquiring the socket lock. This allows iso sock clear timer() to read the iso pi(sk)->conn variable without proper synchronization. Simultaneously, iso conn del() can execute under the socket lock and call iso chan del(), which sets iso pi(sk)->conn to NULL. This lack of stability across the unlock window can lead to a NULL pointer dereference or a use-after-free (UAF) condition, where the system attempts to access memory that has already been freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.