Use-after-free in Linux kernel - CVE-2026-63944
Published: July 20, 2026
Vulnerability identifier: #VU138714
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-63944
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in hci_le_create_cis_sync in the Bluetooth HCI synchronization logic when processing concurrent Bluetooth connection state changes during LE Create CIS handling. A local user can trigger a concurrent disconnect to cause a denial of service.
The stale pointer is dereferenced after both rcu_read_lock() and hci_dev_lock(hdev) are released, and the queued cancellation path does not match the pending work item because it is queued with NULL data but dequeued with the connection pointer.
How to mitigate CVE-2026-63944
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/380e67b1794a9a281a0cb592b4e62077fbd0c8ca
- https://git.kernel.org/stable/c/a55618c0f4cead9e59c63f5ee030d393fd70d861
- https://git.kernel.org/stable/c/a921957d39290143629eb38c4f74b9bef8035d0a
- https://git.kernel.org/stable/c/bfea6091e0fffb270c20e74384b660910277eb6c
- https://git.kernel.org/stable/c/d9019210c8c30d40eb20094274cc647e352f48f7