PT-2026-64627 · Linux · Linux

CVE-2026-64406 · Published 2026-07-25 · Updated 2026-07-25

Mitre

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: fix UAF in bt accept dequeue()

bt accept get() takes a temporary reference before dropping the accept queue lock. bt accept dequeue() currently drops that reference before bt accept unlink(), leaving only the queue reference.

bt accept unlink() drops the queue reference. The subsequent sock hold() therefore accesses freed memory if it was the final reference, as observed by KASAN during listening L2CAP socket cleanup.

Retain the temporary queue-walk reference through unlink and hand it to the caller on success. Drop it explicitly on the closed and not-yet-connected paths.

Related Identifiers

CVE-2026-64406

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-64406 · Security Note
• https://git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8d · Note
• https://git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547 · Note
• https://git.kernel.org/stable/c/c66a95e60b65d876a927123b0ed36bd6177d9ca6 · Note
• https://git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1db · Note
• https://git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9a · Note
• https://git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049 · Note
• https://git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0 · Note
• https://git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614 · Note