Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth subsystem that could lead to a system crash. The issue occurs when the system attempts to manage Bluetooth connection timeouts while the connection is simultaneously being closed, resulting in a 'use-after-free' error. This could potentially allow a local attacker to cause a denial-of-service (system crash) or execute unauthorized code, impacting the stability and security of devices using Bluetooth.
Technical details
A use-after-free (UAF) vulnerability exists in the net/bluetooth/l2cap_core.c component of the Linux kernel. The root cause is a race condition where l2cap_chan_timeout() runs asynchronously and attempts to access chan->conn after the connection has already been torn down and freed. This occurs because the channel does not maintain a proper reference count on the connection object. An attacker could potentially trigger this race condition to cause a kernel panic or achieve arbitrary code execution. The fix involves implementing proper reference counting via l2cap_conn_get and introducing a FLAG_DEL flag to safely track channel deletion status across asynchronous workers.
Affected products
- Linux Linux Kernel 7.1.0-rc6-next-20260601-dirty
Timeline
- 2026-07-25: disclosed: CVE-2026-64434 published
- 2026-07-24: patched: Patch committed to stable tree
References
- https://git.kernel.org/stable/c/0b0e2bf39cf99e458d991b9df253727e036a7d7d
- https://git.kernel.org/stable/c/50c38d9f42a529691e4e67ea9cedf4f0bfc8d277
- https://git.kernel.org/stable/c/91047a4396a8b1857a6f712a90cf33ec0012b189
- https://git.kernel.org/stable/c/b66774b48dd98f07254951f74ea6f513efe7ff8b
- https://git.kernel.org/stable/c/d3b739db5dc6f688a60d56da872fabaf65246032