CVE-2026-64434

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. An asynchronous operation in the l2capchantimeout function can attempt to access a connection that has already been deallocated. This use-after-free vulnerability could allow a local...

UBUNTU-CVE-2024-27399

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: fix null-ptr-deref in l2capchantimeout There is a race condition between l2capchantimeout and l2capchandel. When we use l2capchandel to delete the channel, the chan-conn will be set to null. But the conn could b...

PT-2024-3619

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.9.0-rc5-00356-g78c0094a146b Description: The issue is related to a null pointer dereference bug in the Linux kernel's Bluetooth subsystem, specifically in the l2cap chan timeout function. This bug occurs due t...