PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-63871 Linux CVE debrief

PatchSiren debrief for CVE-2026-63871, a Linux kernel Bluetooth vulnerability. The CVE record was published on 2026-07-19T15:16:54.133Z and has not been modified since then. This vulnerability is a data-race issue in the Linux kernel's Bluetooth ISO implementation, specifically affecting the hci_get_route() function calls in iso_connect_bis(), iso_connect_cis(), iso_listen_bis(), and iso_conn_big_sync(). These functions call hci_get_route() using iso_pi(sk)->dst, iso_pi(sk)->src, and iso_pi(sk)->src_type without holding lock_sock().

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-19
Original CVE updated
2026-07-27
Advisory published
2026-07-19
Advisory updated
2026-07-27

Who should care

Linux kernel users and administrators should review and apply patches for CVE-2026-63871 to prevent potential Bluetooth-related attacks. Affected Linux kernel deployments should be reviewed, and owners assigned for follow-up. Compensating controls for exposed systems should be considered while remediation is scheduled and verified.

Technical summary

CVE-2026-63871 is a data-race vulnerability in the Linux kernel's Bluetooth ISO implementation. The vulnerability occurs when hci_get_route() is called without holding lock_sock(), allowing concurrent modification of iso_pi(sk)->dst, iso_pi(sk)->src, and iso_pi(sk)->src_type. This can result in data-races reported by KCSAN. The issue is resolved by snapshotting the required fields under lock_sock() before calling hci_get_route().

Defensive priority

Medium

Recommended defensive actions

  • Review and apply patches for CVE-2026-63871
  • Monitor Linux kernel updates for CVE-2026-63871 patches
  • Consider implementing compensating controls for Bluetooth-related security
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence for CVE-2026-63871 includes Linux kernel source code changes and KCSAN reports. The CVE record was published on 2026-07-19T15:16:54.133Z and has not been modified since then. To verify, defenders should review Linux kernel source code changes and KCSAN reports for CVE-2026-63871. Linux kernel users and administrators should review and apply patches for CVE-2026-63871 to prevent potential Bluetooth-related attacks.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-63871 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-63871

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-63871 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-63871

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/859bb1f4cb615d98c9c1ab2bd76ebb0b8fe46020

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9798f7d41d85ff763afd1f1cc0533b5c416c8348

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9ca7053d6215d89c33f28893bfd1625a32919d3f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ab84fd7779a2a7ff5d2c8eac212c43733f56216e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.