What is the CVSS score of EUVD-2026-45719?

EUVD-2026-45719 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-45719?

A memory corruption vulnerability in the Linux kernel's Bluetooth ISO subsystem (CVE-2026-63946) allows attackers within Bluetooth range to trigger kernel memory corruption, potentially enabling…. A patch is available.

How to fix or mitigate EUVD-2026-45719?

Within 24 hours, identify and audit all systems using Bluetooth ISO channels to establish deployment scope and risk prioritization. Within 7 days, apply the vendor-released patch to Linux kernel systems where Bluetooth ISO is actively used or cannot be immediately disabled, coordinating updates through standard change management to minimize operational impact. Within 30 days, complete patching across all affected systems and validate remediation through kernel version verification; document any systems unable to patch and implement compensating controls such as disabling Bluetooth ISO or physically isolating affected endpoints from Bluetooth range exposure.

Linux Kernel EUVD-2026-45719

| CVE-2026-63946 HIGH

2026-07-19 Linux

GHSA-9g79-vcq4-5rfr

Information Disclosure Linux

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Bluetooth-range access gives AV:A; winning the lock-drop race window makes AC:H; no auth or interaction needed, and a kernel-socket UAF can compromise confidentiality, integrity, and availability.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:30 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.8 (HIGH)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:55 cve.org

HIGH 8.8

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: fix UAF in iso_recv_frame

iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock before using sk, with no reference held. A concurrent iso_sock_kill() can free sk in that window, causing use-after-free on sk->sk_state and sock_queue_rcv_skb().

Fix by replacing the bare pointer read with iso_sock_hold(conn), which calls sock_hold() while the spinlock is held, atomically elevating the refcount before the lock drops. Add a drop_put label so sock_put() is called on all exit paths where the hold succeeded.

AnalysisAI

Memory corruption in the Linux kernel Bluetooth ISO (Isochronous Channels) subsystem allows an attacker within Bluetooth range to trigger a use-after-free on a socket structure via a race in iso_recv_frame(), where conn->sk is read under iso_conn_lock but dereferenced after the lock drops while a concurrent iso_sock_kill() frees the socket. Successful exploitation can corrupt kernel memory when accessing sk->sk_state and sock_queue_rcv_skb(), enabling denial of service and potentially privilege escalation or code execution in kernel context. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile).

Technical ContextAI

The flaw lives in the Bluetooth ISO (LE Audio Isochronous Channels) socket layer of the kernel's net/bluetooth stack, which handles received ISO frames on established connections. iso_recv_frame() looks up the associated struct sock (conn->sk) while holding iso_conn_lock, but releases the spinlock before using the pointer without taking a reference, so a parallel iso_sock_kill() can free the socket in the resulting window. This is a classic use-after-free (CWE-416) caused by a lifetime/locking mismatch: the pointer is guarded during read but the referenced object is not pinned for the duration of use. The upstream fix replaces the bare pointer read with iso_sock_hold(conn), which calls sock_hold() while still holding the spinlock to atomically elevate the refcount before the lock is dropped, and adds a drop_put label to ensure sock_put() runs on all exit paths.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1 (or later in each series) - and reboot; apply your distribution's backport as soon as it ships (references at https://git.kernel.org/stable/c/c57ea90f203c8b8b41a474f19a09000d0f841436 and companion stable commits). Where immediate patching is not possible, reduce exposure by disabling Bluetooth entirely on systems that do not need it (systemctl disable --now bluetooth and/or rmmod/blacklist the bluetooth and related ISO modules), which fully removes the attack surface at the cost of losing all Bluetooth/LE-Audio functionality. If Bluetooth is required, keep interfaces non-discoverable/non-connectable when idle and restrict pairing to trusted devices to shrink the window in which an attacker can establish the ISO connection needed to reach the vulnerable code path; note this mitigates but does not eliminate risk from already-paired or in-range attackers.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-45719 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-45719

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code