CVE-2026-63944
published 2026-07-19CVE-2026-63944: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync()…
PriorityP348high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.32%
24.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing
both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was
obtained from an RCU-protected iteration over hdev->conn_hash.list and
is not valid once these locks are dropped. A concurrent disconnect can
free the hci_conn between the unlock and the dereference, causing a
use-after-free read.
The cancellation mechanism in hci_conn_del() cannot prevent this because
hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL:
hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL);
While hci_conn_del() dequeues with data=conn:
hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);
Since NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never
matches, and the pending work item is not cancelled.
Fix this by saving conn->conn_timeout into a local variable while the
locks are still held, so the stale conn pointer is never dereferenced
after unlock.
This is the same class of bug as the one fixed by commit 035c25007c9e
("Bluetooth: hci_sync: Fix UAF on le_read_features_complete") which
addressed the identical pattern in a different function.
This vulnerability was identified using 0sec.ai, an open-source
automated security auditing platform (https://github.com/0sec-labs).
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= c09b80be6ffc338634b2f5f8cfa12b6843410834 < a55618c0f4cead9e59c63f5ee030d393fd70d861 | a55618c0f4cead9e59c63f5ee030d393fd70d861 |
| linux | linux | >= c09b80be6ffc338634b2f5f8cfa12b6843410834 < a921957d39290143629eb38c4f74b9bef8035d0a | a921957d39290143629eb38c4f74b9bef8035d0a |
| linux | linux | >= c09b80be6ffc338634b2f5f8cfa12b6843410834 < d9019210c8c30d40eb20094274cc647e352f48f7 | d9019210c8c30d40eb20094274cc647e352f48f7 |
| linux | linux | >= c09b80be6ffc338634b2f5f8cfa12b6843410834 < 380e67b1794a9a281a0cb592b4e62077fbd0c8ca | 380e67b1794a9a281a0cb592b4e62077fbd0c8ca |
| linux | linux | >= c09b80be6ffc338634b2f5f8cfa12b6843410834 < bfea6091e0fffb270c20e74384b660910277eb6c | bfea6091e0fffb270c20e74384b660910277eb6c |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-azure | — | — |
| ubuntu | linux-azure-fde | — | — |
| ubuntu | linux-ibm | — | — |
| ubuntu | linux-oracle | — | — |
| ubuntu | linux-raspi | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
vendor_ubuntu7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-28·CVSS 7.0
CVE-2026-64231 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 platform drivers;
- Cryptographic API;
- PSP security protocol;
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 archit
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-64107 [LOW] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 platfor
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.0
CVE-2026-64107 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 platform drivers;
- PSP security protocol;
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer
Red Hat
kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
vendor_redhat·2026-07-19·CVSS 8.8
CVE-2026-63944 [HIGH] CWE-364 kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free (UAF), allows an attacker to access memory after it has been freed. This can lead to a system crash, resulting in a Denial of Service (DoS), or potentially enable an attacker to execute malicious code. The flaw occurs due to improper handling of connection timeouts during concurrent disconnections.
Package: erlang27 (Red Hat Hardened Images) - Not affected
GHSA
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing bo
ghsa_unreviewed·2026-07-19
CVE-2026-63944 [HIGH] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing bo
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing
both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was
obtained from an RCU-protected iteration over hdev->conn_hash.list and
is not valid once these locks are dropped. A concurrent disconnect can
free the hci_conn between the unlock and the dereference, causing a
use-after-free read.
The cancellation mechanism in hci_conn_del() cannot prevent this because
hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL:
hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL);
While hci_conn_del() dequeues with data=conn:
hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);
Since
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/380e67b1794a9a281a0cb592b4e62077fbd0c8cahttps://git.kernel.org/stable/c/a55618c0f4cead9e59c63f5ee030d393fd70d861https://git.kernel.org/stable/c/a921957d39290143629eb38c4f74b9bef8035d0ahttps://git.kernel.org/stable/c/bfea6091e0fffb270c20e74384b660910277eb6chttps://git.kernel.org/stable/c/d9019210c8c30d40eb20094274cc647e352f48f7
2026-07-19
Published