CVE-2026-63946

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Bluetooth ISO implementation. The iso recv frame() function reads the conn->sk pointer while holding the iso conn lock but releases the lock before utilizing the socket without holding a reference. This creates a race condition where a concurrent call to iso sock kill() can free the socket, leading to a use-after-free when accessing sk->sk state and calling sock queue rcv skb().

Recommendations As a temporary mitigation, restrict the use of Bluetooth ISO functionality until the system is updated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.