CVE-2026-63948

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2capchantimeout on !conn setchantimer takes a l2capchan reference via l2capchanhold before scheduling the delayed work. The normal path in l2capchantimeout drops this reference with...

CVE-2026-63948

A reference leak exists in the Linux kernel Bluetooth L2CAP component within the l2cap_chan_timeout() function. The vulnerability occurs because the code fails to call l2cap_chan_put() during an early return when chan->conn is NULL, leading to a memory reference leak. Remediation involves addi...