Cloudanix VulnDB

CVE-2026-63944

High · 8.8

CVSS

8.8

EPSS

0.3%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the Linux kernel's Bluetooth code can let a nearby attacker crash the device or gain elevated access by manipulating connection timing.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free read in hci_le_create_cis_sync caused by dereferencing a hci_conn pointer obtained under RCU protection after both rcu_read_lock and hci_dev_lock are released; concurrent disconnect via hci_conn_del frees the structure because hci_cmd_sync_dequeue cannot match the queued work item that was submitted with data=NULL.

Why it matters to the business

Kernel memory corruption on Linux Bluetooth devices can lead to crashes, denial of service, or local privilege escalation, affecting system availability and security posture for any organization running vulnerable kernels with Bluetooth enabled.

How an attack unfolds

An attacker with adjacent network access establishes a Bluetooth connection, then forces a concurrent disconnect while hci_le_create_cis_sync is pending; the freed hci_conn is dereferenced when the work item later accesses conn->conn_timeout, resulting in a use-after-free read that can be leveraged for further exploitation.

How to fix it

Update to a kernel containing the fix that saves conn->conn_timeout into a local variable before dropping the locks; apply the same pattern used in commit 035c25007c9e for analogous functions; disable Bluetooth if the update cannot be applied immediately.

How to confirm the fix worked

Confirm the presence of the local-variable save of conn_timeout inside hci_le_create_cis_sync before the unlock sequence; verify that hci_cmd_sync_dequeue calls now correctly cancel pending items or that the function no longer dereferences conn after the locks are released.

Typical attack path

  1. Establish a Bluetooth LE connection to the target
  2. Queue hci_create_cis_sync via hci_cmd_sync_queue with NULL data
  3. Trigger hci_conn_del from a concurrent context to free the hci_conn
  4. Allow the pending work item to dereference the now-freed pointer

How to detect it

Review kernel logs for use-after-free warnings or oops involving hci_le_create_cis_sync or hci_conn; inspect Bluetooth stack traces showing concurrent connect and disconnect sequences around hci_cmd_sync_queue calls.

What your security team should do

  • Prioritize kernel updates for all systems exposing Bluetooth interfaces
  • Audit custom or downstream kernels for the identical RCU-plus-lock dereference pattern
  • Temporarily disable Bluetooth on high-value systems until patches are deployed
  • Monitor kernel oops and Bluetooth-related crash reports for signs of attempted exploitation

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was obtained from an RCU-protected iteration over hdev->conn_hash.list and is not valid once these locks are dropped. A concurrent disconnect can free the hci_conn between the unlock and the dereference, causing a use-after-free read. The cancellation mechanism in hci_conn_del() cannot prevent this because hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL: hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL); While hci_conn_del() dequeues with data=conn: hci_cmd_sync_dequeue(hdev, NULL, conn, NULL); Since NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never matches, and the pending work item is not cancelled. Fix this by saving conn->conn_timeout into a local variable while the locks are still held, so the stale conn pointer is never dereferenced after unlock. This is the same class of bug as the one fixed by commit 035c25007c9e ("Bluetooth: hci_sync: Fix UAF on le_read_features_complete") which addressed the identical pattern in a different function. This vulnerability was identified using 0sec.ai, an open-source automated security auditing platform (https://github.com/0sec-labs).

Affected packages

Ecosystem Package Introduced Fixed