---
id: CVE-2026-64408
title: 'Bluetooth: bnep: pin L2CAP connection during netdev registration'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: bnep: pin L2CAP connection during netdev registration

  bnep_add_connection() reads the L2CAP connection without holding the
  channel lock, then passes its HCI…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 65f53e9802dbfae0e5758a91793c3f5f8bece49b <
    390b5db3ff8745187f094c4e915663b7b1f98944
  - >-
    Linux >= 65f53e9802dbfae0e5758a91793c3f5f8bece49b <
    46a88784c4c9b96954dd86f747ce93f65efa1302
  - >-
    Linux >= 65f53e9802dbfae0e5758a91793c3f5f8bece49b <
    551ae773ec64045b4e72099132654887e0270bcc
  - >-
    Linux >= 65f53e9802dbfae0e5758a91793c3f5f8bece49b <
    ae215c5b6422d8eda443b861b124bd1be6969c31
  - >-
    Linux >= 65f53e9802dbfae0e5758a91793c3f5f8bece49b <
    df22adc7eafc22e651561813c11dc51a796b12ee
  - >-
    Linux >= 65f53e9802dbfae0e5758a91793c3f5f8bece49b <
    a6b22dbd80926556290ad2243be25218d6956a19
  - >-
    Linux >= 65f53e9802dbfae0e5758a91793c3f5f8bece49b <
    563a8573047182f550b1e1e030615755cd8c41da
  - >-
    Linux >= 65f53e9802dbfae0e5758a91793c3f5f8bece49b <
    bb067a99a0356196c0b89a95721985485ebce5a5
  - Linux 3.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:40:17.231928Z'
published: '2026-07-25'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:34.216Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64408'
references:
  - url: 'https://git.kernel.org/stable/c/390b5db3ff8745187f094c4e915663b7b1f98944'
  - url: 'https://git.kernel.org/stable/c/46a88784c4c9b96954dd86f747ce93f65efa1302'
  - url: 'https://git.kernel.org/stable/c/551ae773ec64045b4e72099132654887e0270bcc'
  - url: 'https://git.kernel.org/stable/c/ae215c5b6422d8eda443b861b124bd1be6969c31'
  - url: 'https://git.kernel.org/stable/c/df22adc7eafc22e651561813c11dc51a796b12ee'
  - url: 'https://git.kernel.org/stable/c/a6b22dbd80926556290ad2243be25218d6956a19'
  - url: 'https://git.kernel.org/stable/c/563a8573047182f550b1e1e030615755cd8c41da'
  - url: 'https://git.kernel.org/stable/c/bb067a99a0356196c0b89a95721985485ebce5a5'
tags:
  - cve.org
epss: 0.00262
epssPercentile: 0.1684
ingestedAt: '2026-10-16T17:24:46.816Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bnep: pin L2CAP connection during netdev registration

bnep_add_connection() reads the L2CAP connection without holding the
channel lock, then passes its HCI device to register_netdev(). Controller
teardown can clear and release that connection concurrently, leaving the
network device registration path to dereference a freed parent device.

Take a reference to the L2CAP connection while holding the channel lock.
Retain it until register_netdev() has taken the parent device reference.

## Affected

- `Linux >= 65f53e9802dbfae0e5758a91793c3f5f8bece49b < 390b5db3ff8745187f094c4e915663b7b1f98944`
- `Linux >= 65f53e9802dbfae0e5758a91793c3f5f8bece49b < 46a88784c4c9b96954dd86f747ce93f65efa1302`
- `Linux >= 65f53e9802dbfae0e5758a91793c3f5f8bece49b < 551ae773ec64045b4e72099132654887e0270bcc`
- `Linux >= 65f53e9802dbfae0e5758a91793c3f5f8bece49b < ae215c5b6422d8eda443b861b124bd1be6969c31`
- `Linux >= 65f53e9802dbfae0e5758a91793c3f5f8bece49b < df22adc7eafc22e651561813c11dc51a796b12ee`
- `Linux >= 65f53e9802dbfae0e5758a91793c3f5f8bece49b < a6b22dbd80926556290ad2243be25218d6956a19`
- `Linux >= 65f53e9802dbfae0e5758a91793c3f5f8bece49b < 563a8573047182f550b1e1e030615755cd8c41da`
- `Linux >= 65f53e9802dbfae0e5758a91793c3f5f8bece49b < bb067a99a0356196c0b89a95721985485ebce5a5`
- `Linux 3.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.