CVE-2026-63944 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of Linux-based systems, should be aware of this vulnerability and take steps to mitigate it. Linux kernel developers should review and apply the patch provided by the Linux kernel maintainers. Users of Linux-based systems should ensure that their systems are updated to a version that includes the fix. Additionally, Linux kernel developers and maintainers should monitor Linux kernel updates and security advisories for potential vulnerabilities.

Technical summary

The hci_le_create_cis_sync function dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). A concurrent disconnect can free the hci_conn between the unlock and the dereference, causing a use-after-free read. The cancellation mechanism in hci_conn_del() cannot prevent this because hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL, while hci_conn_del() dequeues with data=conn. The fix involves saving conn->conn_timeout into a local variable while the locks are still held, preventing the stale conn pointer from being dereferenced after unlock.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch provided by the Linux kernel maintainers
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor Linux kernel updates and security advisories for potential vulnerabilities
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was identified using 0sec.ai, an open-source automated security auditing platform. The fix is provided by the Linux kernel maintainers and is available in the stable kernel tree. Linux kernel developers should verify the patch and update their systems accordingly. The 0sec.ai platform provides an open-source solution for identifying potential security vulnerabilities. Evidence of the vulnerability includes the CVE record and the associated Linux kernel patch. Additional verification steps are recommended to ensure the vulnerability is properly mitigated.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.