CVE-2026-74540

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix UAF in l2capleconnectrsp l2capleconnectrsp obtains a channel via l2capgetchanbyident but neither holds a reference nor uses l2capchanholdunlesszero before locking and operating on it. A concurrent l2capchand...

CVE-2026-11368: Use After Free

The Bluetooth host ATT layer subsys/bluetooth/host/att.c associates each in-flight ATT TX buffer with its owning channel via the static txmetadatastorage array data-attchan = chan. When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system...

CVE-2026-63975: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2capecredconnrsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2capchandel may invalidate the tmp cursor...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: l2cap: fixed a nullptrderef in l2capchantimeout There is a race condition between l2capchantimeout and l2capchandel. When we use l2capchandel to delete the channel, the chan-conn will be set to null. However, the co...