CVE-2026-63944 - Vulnerability Details

- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync

hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing
both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was
obtained from an RCU-protected iteration over hdev->conn_hash.list and
is not valid once these locks are dropped. A concurrent disconnect can
free the hci_conn between the unlock and the dereference, causing a
use-after-free read.

The cancellation mechanism in hci_conn_del() cannot prevent this because
hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL:

hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL);

While hci_conn_del() dequeues with data=conn:

hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);

Since NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never
matches, and the pending work item is not cancelled.

Fix this by saving conn->conn_timeout into a local variable while the
locks are still held, so the stale conn pointer is never dereferenced
after unlock.

This is the same class of bug as the one fixed by commit 035c25007c9e
("Bluetooth: hci_sync: Fix UAF on le_read_features_complete") which
addressed the identical pattern in a different function.

This vulnerability was identified using 0sec.ai, an open-source
automated security auditing platform (https://github.com/0sec-labs).

Published: 2026-07-19

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw arises in the Bluetooth hci_sync subsystem where hci_le_create_cis_sync dereferences a connection object after releasing RCU and device locks. A concurrent disconnect can free the hci_conn structure between the unlock and dereference, causing a read of a freed kernel object. This use‑after‑free read can corrupt trusted kernel memory, leading to crashes, data corruption, or a foothold for privilege escalation if additional weaknesses are chained.

Affected Systems

All Linux kernel builds that include the Bluetooth stack and the hci_sync feature are affected. Any distribution running a kernel version that does not yet contain the described commit is susceptible, regardless of specific hardware models or Bluetooth adapters.

Risk and Exploitability

The vulnerability has a CVSS score of 8.8, indicating high severity. The EPSS score of less than 1 % indicates a low current likelihood of exploitation, and it is not listed in the CISA KEV catalog. Exploitation would likely require local or privileged access and a carefully orchestrated race condition where a disconnect occurs concurrently with the synchronized operation. The issue is a classic CWE‑364 type improper lock release leading to use‑after‑free.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c09b80be6ffc338634b2f5f8cfa12b6843410834`	affected	< a55618c0f4cead9e59c63f5ee030d393fd70d861
`c09b80be6ffc338634b2f5f8cfa12b6843410834`	affected	< a921957d39290143629eb38c4f74b9bef8035d0a
`c09b80be6ffc338634b2f5f8cfa12b6843410834`	affected	< d9019210c8c30d40eb20094274cc647e352f48f7
`c09b80be6ffc338634b2f5f8cfa12b6843410834`	affected	< 380e67b1794a9a281a0cb592b4e62077fbd0c8ca
`c09b80be6ffc338634b2f5f8cfa12b6843410834`	affected	< bfea6091e0fffb270c20e74384b660910277eb6c

Linux

affected

Version	Status	Constraints
`6.4`	affected	—
`0`	unaffected	< 6.4
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c09b80be6ffc338634b2f5f8cfa12b6843410834,a55618c0f4cead9e59c63f5ee030d393fd70d861)`	affected	code_commit	—
`[c09b80be6ffc338634b2f5f8cfa12b6843410834,a921957d39290143629eb38c4f74b9bef8035d0a)`	affected	code_commit	—
`[c09b80be6ffc338634b2f5f8cfa12b6843410834,d9019210c8c30d40eb20094274cc647e352f48f7)`	affected	code_commit	—
`[c09b80be6ffc338634b2f5f8cfa12b6843410834,380e67b1794a9a281a0cb592b4e62077fbd0c8ca)`	affected	code_commit	—
`[c09b80be6ffc338634b2f5f8cfa12b6843410834,bfea6091e0fffb270c20e74384b660910277eb6c)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.4`	affected	generic	—
`[0,6.4)`	unaffected	generic	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a kernel version that includes the commit fixing the use‑after‑free in hci_le_create_cis_sync
If a kernel upgrade is not immediately possible, disable or restrict Bluetooth services to prevent execution of the vulnerable code path
Ensure no active Bluetooth connections remain during system shutdown or network reconfiguration to reduce the likelihood of a concurrent disconnect race

Generated by OpenCVE AI on August 4, 2026 at 06:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00324.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/380e67b1794a9a281a0cb592b4e62077fbd0c8ca
https://git.kernel.org/stable/c/a55618c0f4cead9e59c63f5ee030d393fd70d861
https://git.kernel.org/stable/c/a921957d39290143629eb38c4f74b9bef8035d0a
https://git.kernel.org/stable/c/bfea6091e0fffb270c20e74384b660910277eb6c
https://git.kernel.org/stable/c/d9019210c8c30d40eb20094274cc647e352f48f7
https://lore.kernel.org/linux-cve-announce/2026071953-CVE-2026-63944-d15d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63944
https://www.cve.org/CVERecord?id=CVE-2026-63944

History

Wed, 22 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-364
References		https://lore.kernel.org/linux-cve-announce/2026071953-CVE-2026-63944-d15d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63944 https://www.cve.org/CVERecord?id=CVE-2026-63944
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was obtained from an RCU-protected iteration over hdev->conn_hash.list and is not valid once these locks are dropped. A concurrent disconnect can free the hci_conn between the unlock and the dereference, causing a use-after-free read. The cancellation mechanism in hci_conn_del() cannot prevent this because hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL: hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL); While hci_conn_del() dequeues with data=conn: hci_cmd_sync_dequeue(hdev, NULL, conn, NULL); Since NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never matches, and the pending work item is not cancelled. Fix this by saving conn->conn_timeout into a local variable while the locks are still held, so the stale conn pointer is never dereferenced after unlock. This is the same class of bug as the one fixed by commit 035c25007c9e ("Bluetooth: hci_sync: Fix UAF on le_read_features_complete") which addressed the identical pattern in a different function. This vulnerability was identified using 0sec.ai, an open-source automated security auditing platform (https://github.com/0sec-labs).
Title		Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/380e67b1794a9a281a0cb592b4e62077fbd0c8ca https://git.kernel.org/stable/c/a55618c0f4cead9e59c63f5ee030d393fd70d861 https://git.kernel.org/stable/c/a921957d39290143629eb38c4f74b9bef8035d0a https://git.kernel.org/stable/c/bfea6091e0fffb270c20e74384b660910277eb6c https://git.kernel.org/stable/c/d9019210c8c30d40eb20094274cc647e352f48f7

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:55:39.105Z

Updated: 2026-08-05T12:37:30.950Z

Reserved: 2026-07-19T07:54:57.022Z

Link: CVE-2026-63944

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63944 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T06:45:03Z

Weaknesses

CWE-364
Signal Handler Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object