SUSE CVE-2026-64434

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

CVE-2026-64434

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

UBUNTU-CVE-2026-64434

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

EUVD-2026-48778

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

CVE-2026-64434 Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

CVE-2026-64434

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

CVE-2026-64434

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

CVE-2026-64434 Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

CVE-2026-64434

The provided reports (Linux kernel CVE-2026-64434) detail a use-after-free in Bluetooth L2CAP channel timeout (l2cap_chan_timeout) where chan->conn could be freed while a timer is pending. The effective fix is to have the channel hold a reference to the associated l2cap_conn (via l2cap_conn_ge...

PT-2026-64655

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2cap chan timeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading...

Linux Distros Unpatched Vulnerability : CVE-2026-64434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down whi...

CVE-2026-63948

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol L2CAP component. A reference leak occurs in the l2capchantimeout function. When a channel's connection is null, an early exit path in the function fails to release a held channel reference. This oversigh...

CVE-2026-63975

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2capecredconnrsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2capchandel may invalidate the tmp cursor...

EUVD-2026-45748

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2capecredconnrsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2capchandel may invalidate the tmp cursor...

CVE-2026-63948 Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2capchantimeout on !conn setchantimer takes a l2capchan reference via l2capchanhold before scheduling the delayed work. The normal path in l2capchantimeout drops this reference with...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Hyper-V provides the ability to connect Fibre Channel LUNs to the host system and present them as SCSI devices in a guest VM. I/O operations to the vFC device are...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005600)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005600 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Hyper-V provides the ability to...

kernel: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: fix null-ptr-deref in l2capchantimeout There is a race condition between l2capchantimeout and l2capchandel. When we use l2capchandel to delete the channel, the chan-conn will be set to null. But the conn could b...

kernel: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: fix null-ptr-deref in l2capchantimeout There is a race condition between l2capchantimeout and l2capchandel. When we use l2capchandel to delete the channel, the chan-conn will be set to null. But the conn could b...

kernel: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: fix null-ptr-deref in l2capchantimeout There is a race condition between l2capchantimeout and l2capchandel. When we use l2capchandel to delete the channel, the chan-conn will be set to null. But the conn could b...