PT-2026-65735 · Linux · Linux
CVE-2026-64557
·
Published
2026-07-29
·
Updated
2026-07-29
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix use-after-free in l2cap sock new connection cb()
l2cap sock new connection cb() returned l2cap pi(sk)->chan after
release sock(parent). Once the parent lock is dropped the newly
enqueued child socket sk is reachable via the accept queue, so another
task can accept and free it before the callback dereferences sk,
resulting in a use-after-free.
Rework the ->new connection() op so the core, rather than the callback,
owns the child channel's lifetime. The op now receives a pre-allocated
new chan and returns an errno instead of allocating and returning a
channel. l2cap new connection() allocates the child channel and links
it into the conn list via l2cap chan add() before invoking the
callback, so the conn-list reference keeps the channel alive once
release sock(parent) exposes the socket to other tasks.
Channel configuration that was duplicated in l2cap sock init() and the
various new connection callbacks is consolidated into
l2cap chan set defaults(), which now inherits from the parent channel
when one is supplied.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux