{"id":"CVE-2026-64557","title":"Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n\nl2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after\nrelease_sock(parent). Once the …","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 8ffb929098a56939ac71509302eeab5b207bf262 < b39298044e5534612511a2ff5de03ba5f6e7a820","Linux >= 8ffb929098a56939ac71509302eeab5b207bf262 < 8c37e4338c801ebb8cee52436c01c41e009f6e87","Linux >= 8ffb929098a56939ac71509302eeab5b207bf262 < 84e718b6a814edc84159361f9f454a4e92ae91ae","Linux >= 8ffb929098a56939ac71509302eeab5b207bf262 < 36da806f7fbaee56ad9e81859deec203f9728700","Linux >= 8ffb929098a56939ac71509302eeab5b207bf262 < 733e76e74e406c1d1ddc7369420dd8a47f48bb8a","Linux >= 8ffb929098a56939ac71509302eeab5b207bf262 < 6fef032af0092ed5ccb767239a9ac1bc38c08a40","Linux 3.13"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:42:36.931417Z"},"published":"2026-07-29","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:52:52.563Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64557","references":[{"url":"https://git.kernel.org/stable/c/b39298044e5534612511a2ff5de03ba5f6e7a820"},{"url":"https://git.kernel.org/stable/c/8c37e4338c801ebb8cee52436c01c41e009f6e87"},{"url":"https://git.kernel.org/stable/c/84e718b6a814edc84159361f9f454a4e92ae91ae"},{"url":"https://git.kernel.org/stable/c/36da806f7fbaee56ad9e81859deec203f9728700"},{"url":"https://git.kernel.org/stable/c/733e76e74e406c1d1ddc7369420dd8a47f48bb8a"},{"url":"https://git.kernel.org/stable/c/6fef032af0092ed5ccb767239a9ac1bc38c08a40"}],"tags":["cve.org"],"epss":0.00241,"epssPercentile":0.1416,"ingestedAt":"2026-10-16T17:24:46.834Z","slug":"CVE-2026-64557","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n\nl2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after\nrelease_sock(parent). Once the parent lock is dropped the newly\nenqueued child socket sk is reachable via the accept queue, so another\ntask can accept and free it before the callback dereferences sk,\nresulting in a use-after-free.\n\nRework the ->new_connection() op so the core, rather than the callback,\nowns the child channel's lifetime. The op now receives a pre-allocated\nnew_chan and returns an errno instead of allocating and returning a\nchannel. l2cap_new_connection() allocates the child channel and links\nit into the conn list via __l2cap_chan_add() before invoking the\ncallback, so the conn-list reference keeps the channel alive once\nrelease_sock(parent) exposes the socket to other tasks.\n\nChannel configuration that was duplicated in l2cap_sock_init() and the\nvarious new_connection callbacks is consolidated into\nl2cap_chan_set_defaults(), which now inherits from the parent channel\nwhen one is supplied.\n\n## Affected\n\n- `Linux >= 8ffb929098a56939ac71509302eeab5b207bf262 < b39298044e5534612511a2ff5de03ba5f6e7a820`\n- `Linux >= 8ffb929098a56939ac71509302eeab5b207bf262 < 8c37e4338c801ebb8cee52436c01c41e009f6e87`\n- `Linux >= 8ffb929098a56939ac71509302eeab5b207bf262 < 84e718b6a814edc84159361f9f454a4e92ae91ae`\n- `Linux >= 8ffb929098a56939ac71509302eeab5b207bf262 < 36da806f7fbaee56ad9e81859deec203f9728700`\n- `Linux >= 8ffb929098a56939ac71509302eeab5b207bf262 < 733e76e74e406c1d1ddc7369420dd8a47f48bb8a`\n- `Linux >= 8ffb929098a56939ac71509302eeab5b207bf262 < 6fef032af0092ed5ccb767239a9ac1bc38c08a40`\n- `Linux 3.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}