CVE-2026-63944 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was obtained from an RCU-protected iteration over hdev->conn_hash.list and is not valid once these locks are dropped. A concurrent disconnect can free the hci_conn between the unlock and the dereference, causing a use-after-free read.
The cancellation mechanism in hci_conn_del() cannot prevent this because hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL:
hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL);
While hci_conn_del() dequeues with data=conn:
hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);
Since NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never matches, and the pending work item is not cancelled.
Fix this by saving conn->conn_timeout into a local variable while the locks are still held, so the stale conn pointer is never dereferenced after unlock.
This is the same class of bug as the one fixed by commit 035c25007c9e ("Bluetooth: hci_sync: Fix UAF on le_read_features_complete") which addressed the identical pattern in a different function.
This vulnerability was identified using 0sec.ai, an open-source automated security auditing platform (https://github.com/0sec-labs).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability described represents a use-after-free condition affecting the Linux kernel's Bluetooth subsystem, specifically within the hci_le_create_cis_sync() function. This flaw occurs during the handling of Bluetooth connection establishment processes where improper lock management creates a window for memory corruption attacks. The issue stems from the dereference of conn->conn_timeout after releasing critical synchronization primitives including rcu_read_lock() and hci_dev_lock(hdev). The connection pointer conn is obtained through an RCU-protected iteration over hdev->conn_hash.list, making it inherently unstable once these locks are released.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially enable privilege escalation and system instability. When concurrent disconnect operations occur between the release of synchronization locks and the subsequent dereference of the connection pointer, the memory location previously occupied by the hci_conn structure may be freed and reallocated. This creates a scenario where the kernel attempts to access memory that no longer contains valid connection data, leading to unpredictable behavior and potential exploitation. The vulnerability classifies under CWE-416 as a Use After Free condition, which represents one of the most critical categories of memory safety issues in kernel space.
The root cause lies in the improper handling of command synchronization mechanisms within the Bluetooth subsystem. The hci_conn_del() function's cancellation mechanism fails because the pending work item queued by hci_le_create_cis_pending() uses data=NULL during queuing, while hci_conn_del() attempts to dequeue with data=conn. This mismatch prevents the _hci_cmd_sync_lookup_entry() function from matching and cancelling the pending operation, leaving the stale pointer vulnerable to exploitation. The fix implements a standard defensive programming pattern by storing conn->conn_timeout into a local variable while locks remain active, ensuring that no dereference occurs after lock release.
This vulnerability demonstrates patterns consistent with ATT&CK technique T1068 which involves exploiting weaknesses in system security to gain privileges and persistence. The issue has been classified as affecting the Bluetooth subsystem's HCI (Host Controller Interface) layer, specifically within connection synchronization mechanisms. Similar vulnerabilities have been previously addressed in related functions through commits like 035c25007c9e ("Bluetooth: hci_sync: Fix UAF on le_read_features_complete"), indicating this represents a recurring pattern of improper lock management in kernel Bluetooth implementations. The discovery through automated auditing platforms like 0sec.ai underscores the importance of systematic security analysis for maintaining kernel stability and preventing privilege escalation attacks that could compromise entire system operations.
The fix addresses fundamental synchronization issues that could enable attackers to manipulate kernel memory layouts and potentially execute arbitrary code with kernel privileges. This vulnerability represents a critical risk in environments where Bluetooth connectivity is actively managed, particularly in mobile devices, IoT systems, and embedded platforms where kernel-level exploits can have severe consequences for overall system security posture.