CVE-2026-63946Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in iso_recv_frame iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock before using sk, with no reference held. A concurrent iso_sock_kill() can free sk in that window, causing use-after-free on sk->sk_state and sock_queue_rcv_skb(). Fix by replacing the bare pointer read with iso_sock_hold(conn), which calls sock_hold() while the spinlock is held, atomically elevating the refcount before the lock drops. Add a drop_put label so sock_put() is called on all exit paths where the hold succeeded.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-416

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

DFIR Lab@DFIR_Lab91d
Disclosure
🚨 HIGH: CVE-2026-63946 (CVSS 8.8) Linux kernel Bluetooth ISO use-after-free vulnerability. Concurrent operations can trigger UAF on socket state, potentially leading to code execution. Affected: Linux kernel Bluetooth subsystem #CVE #Vulnerability #PatchNow https://t.co/mPDgNi4AX5
Post summary
The tweet announces a new high‑severity Linux kernel Bluetooth use‑after‑free vulnerability (CVE‑2026‑63946, CVSS 8.8), highlighting the technical details and urging patching.
0000036
91 followersView on X

Explore more

Back to dashboard