PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-63944 Linux CVE debrief

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem. The vulnerability occurs in the hci_le_create_cis_sync function, where a concurrent disconnect can free the hci_conn between the unlock and the dereference, causing a use-after-free read. This vulnerability can be exploited by an attacker to potentially execute arbitrary code or cause a denial of service. Linux kernel developers and maintainers should be aware of this vulnerability and take steps to mitigate it. The vulnerability has been resolved by saving conn->conn_timeout into a local variable while the locks are still held, preventing the stale conn pointer from being dereferenced after unlock.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-19
Original CVE updated
2026-07-19
Advisory published
2026-07-19
Advisory updated
2026-07-19

Who should care

Linux kernel developers and maintainers, as well as users of Linux-based systems, should be aware of this vulnerability and take steps to mitigate it. Linux kernel developers should review and apply the patch provided by the Linux kernel maintainers. Users of Linux-based systems should ensure that their systems are updated to a version that includes the fix. Additionally, Linux kernel developers and maintainers should monitor Linux kernel updates and security advisories for potential vulnerabilities.

Technical summary

The hci_le_create_cis_sync function dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). A concurrent disconnect can free the hci_conn between the unlock and the dereference, causing a use-after-free read. The cancellation mechanism in hci_conn_del() cannot prevent this because hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL, while hci_conn_del() dequeues with data=conn. The fix involves saving conn->conn_timeout into a local variable while the locks are still held, preventing the stale conn pointer from being dereferenced after unlock.

Defensive priority

High

Recommended defensive actions

  • Review and apply the patch provided by the Linux kernel maintainers
  • Ensure that the Linux kernel is updated to a version that includes the fix
  • Monitor Linux kernel updates and security advisories for potential vulnerabilities
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was identified using 0sec.ai, an open-source automated security auditing platform. The fix is provided by the Linux kernel maintainers and is available in the stable kernel tree. Linux kernel developers should verify the patch and update their systems accordingly. The 0sec.ai platform provides an open-source solution for identifying potential security vulnerabilities. Evidence of the vulnerability includes the CVE record and the associated Linux kernel patch. Additional verification steps are recommended to ensure the vulnerability is properly mitigated.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-19T16:17:12.990Z and has not been modified since then.