Executive brief
A security vulnerability has been identified in the Linux kernel's Bluetooth subsystem. This flaw could allow a nearby attacker to cause a system crash or potentially execute unauthorized actions by exploiting a timing issue during Bluetooth connection setup. The issue specifically affects how the system handles connection timeouts when a device unexpectedly disconnects.
Technical details
A use-after-free (UAF) vulnerability exists in net/bluetooth/hci_sync.c within the hci_le_create_cis_sync function. The root cause is a race condition where a connection pointer (hci_conn) is dereferenced to access 'conn_timeout' after the RCU read lock and hci_dev_lock have been released. If a concurrent disconnect occurs, the connection object may be freed before the dereference happens. The vulnerability is exacerbated by a failure in the cancellation mechanism (hci_conn_del) which fails to dequeue pending work items because of a pointer mismatch (NULL vs conn). Attackers within Bluetooth range could trigger this by initiating and then rapidly terminating LE Connected Isochronous Stream (CIS) connections. Patches have been released for multiple stable kernel branches including 6.1, 6.6, and 6.9.
Affected products
- Linux Linux Kernel 6.4 to 6.9.x
Timeline
- 2026-05-25: disclosed: Vulnerability identified by 0sec.ai
- 2026-06-09: patched: Fix committed to stable kernel trees
- 2026-07-19: advisory: CVE-2026-63944 published
References
- https://git.kernel.org/stable/c/380e67b1794a9a281a0cb592b4e62077fbd0c8ca
- https://git.kernel.org/stable/c/a55618c0f4cead9e59c63f5ee030d393fd70d861
- https://git.kernel.org/stable/c/a921957d39290143629eb38c4f74b9bef8035d0a
- https://git.kernel.org/stable/c/bfea6091e0fffb270c20e74384b660910277eb6c
- https://git.kernel.org/stable/c/d9019210c8c30d40eb20094274cc647e352f48f7