CVE-2026-63948

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2capchantimeout on !conn setchantimer takes a l2capchan reference via l2capchanhold before scheduling the delayed work. The normal path in l2capchantimeout drops this reference with...

CVE-2026-63948

The CVE affects the Linux kernel Bluetooth L2CAP stack, where l2cap_chan_timeout() leaks a l2cap_chan reference when chan->conn is NULL because the early return skips l2cap_chan_put() after __set_chan_timer() holds the reference via l2cap_chan_hold(). The fix adds the missing l2cap_chan_put() ...