SECUFOCUSNOW
Home›CVE index›CVE-2026-63944
Review reviewHigh

CVE-2026-63944

Linux

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was obtained from an RCU-protected iteration over hdev->conn_hash.list and is not valid once these locks are dropped. A concurrent disconnect can free the hci_conn between the unlock and the dereference, causing a use-after-free read. The cancellation mechanism in hci_conn_del() cannot prevent this because hci_le_create_cis_pending() que...

CVSS
8.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.20
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 8.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was obtained from an RCU-protected iteration over hdev->conn_hash.list and is not valid once these locks are dropped. A concurrent disconnect can free the hci_conn between the unlock and the dereference, causing a use-after-free read. The cancellation mechanism in hci_conn_del() cannot prevent this because hci_le_create_cis_pending() que...

Affected product and versions

Product
Linux
Affected versions
>= c09b80be6ffc338634b2f5f8cfa12b6843410834 < a55618c0f4cead9e59c63f5ee030d393fd70d861, >= c09b80be6ffc338634b2f5f8cfa12b6843410834 < a921957d39290143629eb38c4f74b9bef8035d0a, >= c09b80be6ffc338634b2f5f8cfa12b6843410834 < d9019210c8c30d40eb20094274cc647e352f48f7, >= c09b80be6ffc338634b2f5f8cfa12b6843410834 < 380e67b1794a9a281a0cb592b4e62077fbd0c8ca, >= c09b80be6ffc338634b2f5f8cfa12b6843410834 < bfea6091e0fffb270c20e74384b660910277eb6c, >= 6.4
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available