SB20260720298 - Use-after-free in Linux kernel bluetooth

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260720298

SB20260720298 - Use-after-free in Linux kernel bluetooth

Published: July 20, 2026

Security Bulletin ID SB20260720298
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use-after-free (CVE-ID: CVE-2026-63944)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in hci_le_create_cis_sync in the Bluetooth HCI synchronization logic when processing concurrent Bluetooth connection state changes during LE Create CIS handling. A local user can trigger a concurrent disconnect to cause a denial of service.

The stale pointer is dereferenced after both rcu_read_lock() and hci_dev_lock(hdev) are released, and the queued cancellation path does not match the pending work item because it is queued with NULL data but dequeued with the connection pointer.


Remediation

Install update from vendor's website.

References