CVE-2026-63945

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

iso_sock_close() calls iso_sock_clear_timer() before acquiring

lock_sock(sk).

iso_sock_clear_timer() reads iso_pi(sk)->conn twice without the

socket lock held:

if (!iso_pi(sk)->conn)

return;

cancel_delayed_work(&iso_pi(sk)->conn->timeout_work);

Concurrently, iso_conn_del() executes under lock_sock(sk) and calls

iso_chan_del(), which sets iso_pi(sk)->conn to NULL and may result in

the final reference to the connection being dropped:

CPU0 CPU1

---- ----

iso_sock_clear_timer()

if (conn != NULL) ... lock_sock(sk)

iso_chan_del()

iso_pi(sk)->conn = NULL

cancel_delayed_work(conn) /* NULL deref or UAF */

iso_pi(sk)->conn is not stable across the unlock window, causing a

NULL pointer dereference o

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References