Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth subsystem that could lead to a system crash or unpredictable behavior. The issue occurs when the system handles incoming Bluetooth connections, specifically during the cleanup of certain network sockets. An attacker could potentially exploit this to cause a denial-of-service or gain unauthorized access to system memory.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel Bluetooth stack within the bt_accept_dequeue() function. The root cause is a race condition where bt_accept_get() takes a temporary reference that is dropped prematurely before bt_accept_unlink() is called. When bt_accept_unlink() drops the final queue reference, subsequent calls to sock_hold() access memory that has already been freed. This was specifically observed during L2CAP socket cleanup. The fix involves retaining the temporary queue-walk reference through the unlink process and ensuring it is only dropped after the socket is safely handed off or closed.
Affected products
- Linux Linux Kernel 5.10.259 to 5.10.261; 5.15.210 to 5.15.212; 6.1.175 to 6.1.178; and others up to 7.1.y
Timeline
- 2026-07-25: advisory: CVE-2026-64406 published by NVD
- 2026-07-24: patched: Fix committed to Linux stable tree by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0
- https://git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614
- https://git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9a
- https://git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049
- https://git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1db
- https://git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547
- https://git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8d