CVE-2026-19935

The Bluetooth LE host queues received L2CAP connection-oriented channel CoC data for deferred processing through a struct kwork embedded in the channel object lechan-rxwork, handler l2caprxprocess whenever the channel uses a dynamic PSM 0x0080-0x00FF. Channel teardown in l2capchandestroy in...

CVE-2026-19935 Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown

The Bluetooth LE host queues received L2CAP connection-oriented channel CoC data for deferred processing through a struct kwork embedded in the channel object lechan-rxwork, handler l2caprxprocess whenever the channel uses a dynamic PSM 0x0080-0x00FF. Channel teardown in l2capchandestroy in...

CVE-2022-50386: Use After Free

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2capchanholdunlesszero after calling l2capgetchanblah to prevent the following trace: Bluetooth: l2capcore.c:static void l2capchandestroystruct kref kref Bluetooth: chan...