PT-2026-64627 · Linux · Linux

CVE-2026-64406 · Publicado 2026-07-25 · Atualizado 2026-07-25

Mitre

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: fix UAF in bt accept dequeue()

bt accept get() takes a temporary reference before dropping the accept queue lock. bt accept dequeue() currently drops that reference before bt accept unlink(), leaving only the queue reference.

bt accept unlink() drops the queue reference. The subsequent sock hold() therefore accesses freed memory if it was the final reference, as observed by KASAN during listening L2CAP socket cleanup.

Retain the temporary queue-walk reference through unlink and hand it to the caller on success. Drop it explicitly on the closed and not-yet-connected paths.

Identificadores relacionados

CVE-2026-64406

Produtos afetados

Linux

Referências · 9

• https://git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8d · Nota
• https://git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547 · Nota
• https://git.kernel.org/stable/c/c66a95e60b65d876a927123b0ed36bd6177d9ca6 · Nota
• https://git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1db · Nota
• https://git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9a · Nota
• https://git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049 · Nota
• https://git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0 · Nota
• https://git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-64406 · Nota de Segurança