CVE-2026-63946 is a use-after-free vulnerability in the Linux kernel Bluetooth ISO subsystem. The iso_recv_frame function reads the socket pointer conn->sk under a lock but releases the lock before using the socket without holding a reference. This allows a concurrent iso_sock_kill() call to free the socket, leading to use-after-free on socket state and receive queue functions. The vulnerability was fixed by replacing the bare pointer read with a call to iso_sock_hold(conn), which atomically increments the socket reference count while the lock is held, preventing the socket from being freed prematurely.

This vulnerability could lead to use-after-free conditions in the Bluetooth ISO code path of the Linux kernel, potentially causing kernel crashes or undefined behavior. No known exploits in the wild have been reported. The impact is limited to systems running vulnerable Linux kernel versions with Bluetooth ISO support.

A fix has been implemented in the Linux kernel to address this vulnerability by properly managing socket references in the iso_recv_frame function. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation guidance.