CVE-2026-63871

Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls

published July 19, 2026

CVSS
—
EPSS
0%
Percentile
5.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls

iso_connect_bis(), iso_connect_cis(), iso_listen_bis(), and

iso_conn_big_sync() call hci_get_route() using iso_pi(sk)->dst,

iso_pi(sk)->src, and iso_pi(sk)->src_type without holding lock_sock().

These fields may be modified concurrently by connect() or setsockopt()

on the same socket, resulting in data-races reported by KCSAN.

Fix this by snapshotting the required fields under lock_sock() before

calling hci_get_route().

BUG: KCSAN: data-race in memcmp+0x45/0xb0

race at unknown origin, with read to 0xffff8880122135cf of 1 bytes

by task 333 on cpu 1:

memcmp+0x45/0xb0

hci_get_route+0x27e/0x490

iso_connect_cis+0x4c/0xa10

iso_sock_connect+0x60e/0xb30

__sys_connect_file+0xbd/0xe0

__sys_connect+0xe0/0x110

__x64_sys_connect+0x40/0x50

x64_sys_call+0xcad/0x1c60

do_syscall_64+0x133/0x590

entry_SYSCALL_64_after_hwframe+0x77/0x7f

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00166 · 5.5th percentile
Published
2026-07-19T14:18Z
EPSS history
Timeline
  • 19 JUL 14:18Z
    Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
    cvelistv5