CVE-2026-63946

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: fix UAF in isorecvframe

isorecvframe reads conn->sk under isoconnlock but releases the lock before using sk, with no reference held. A concurrent isosockkill() can free sk in that window, causing use-after-free on sk->skstate and sockqueuercvskb().

Fix by replacing the bare pointer read with isosockhold(conn), which calls sockhold() while the spinlock is held, atomically elevating the refcount before the lock drops. Add a dropput label so sock_put() is called on all exit paths where the hold succeeded.