CVE-2026-64434

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. An asynchronous operation in the l2capchantimeout function can attempt to access a connection that has already been deallocated. This use-after-free vulnerability could allow a local...

CVE-2026-64557

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2capsocknewconnectioncb l2capsocknewconnectioncb returned l2cappisk-chan after releasesockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable via the...

CVE-2026-64557

Summary: CVE-2026-64557 affects the Linux kernel Bluetooth L2CAP implementation, causing a use-after-free during new Bluetooth connections. The bug occurs when l2cap_sock_new_connection_cb() returns the new channel after release_sock(parent); once the parent lock is dropped, the enqueued child so...

MiracleLinux 8 : kernel-4.18.0-553.146.1.el8_10 (AXSA:2026-1384:55)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1384:55 advisory. kernel: RDMA/mana: Remove user triggerable WARNON in manaibcreateqprss CVE-2026-46117 kernel: Bluetooth: l2cap: Add missing chan lock in...

SUSE CVE-2026-64434

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

CVE-2026-64403

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2capgetconfopt derives the option length from the attacker-controlled opt-len field and immediately dereferences opt-val as u8, getunalignedle16 or...

CVE-2026-64434

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

CVE-2026-64408

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnepaddconnection reads the L2CAP connection without holding the channel lock, then passes its HCI device to registernetdev. Controller teardown can clear and relea...

UBUNTU-CVE-2026-64403

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2capgetconfopt derives the option length from the attacker-controlled opt-len field and immediately dereferences opt-val as u8, getunalignedle16 or...

EUVD-2026-48778

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

CVE-2026-64434 Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

CVE-2026-64434

The provided reports (Linux kernel CVE-2026-64434) detail a use-after-free in Bluetooth L2CAP channel timeout (l2cap_chan_timeout) where chan->conn could be freed while a timer is pending. The effective fix is to have the channel hold a reference to the associated l2cap_conn (via l2cap_conn_ge...

CVE-2026-64408

The CVE concerns the Linux kernel Bluetooth BNEP path: during netdev registration, bnep_add_connection() reads the L2CAP connection without holding the channel lock, and passes the HCI device to register_netdev() while a controller teardown could clear the connection. The published fix is to take...

CVE-2026-64408 Bluetooth: bnep: pin L2CAP connection during netdev registration

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnepaddconnection reads the L2CAP connection without holding the channel lock, then passes its HCI device to registernetdev. Controller teardown can clear and relea...

EUVD-2026-48952

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnepaddconnection reads the L2CAP connection without holding the channel lock, then passes its HCI device to registernetdev. Controller teardown can clear and relea...

CVE-2026-64403 Bluetooth: L2CAP: validate option length before reading conf opt value

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2capgetconfopt derives the option length from the attacker-controlled opt-len field and immediately dereferences opt-val as u8, getunalignedle16 or...

PT-2026-64629

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth BNEP Bluetooth Network Encapsulation Protocol component where the bnep add connection function reads the L2CAP connection without holding the channel loc...

Linux Distros Unpatched Vulnerability : CVE-2026-64406

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: fix UAF in btacceptdequeue btacceptget takes a temporary reference before dropping the accept queue lock. btacceptdequeue currently drops that...

Linux Distros Unpatched Vulnerability : CVE-2026-64403

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: validate option length before reading conf opt value l2capgetconfopt derives the option length from the attacker-controlled opt-len field and...

Linux Distros Unpatched Vulnerability : CVE-2026-64408

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: bnep: pin L2CAP connection during netdev registration bnepaddconnection reads the L2CAP connection without holding the channel lock, then passes its...