CVE-2026-64434

The provided reports (Linux kernel CVE-2026-64434) detail a use-after-free in Bluetooth L2CAP channel timeout (l2cap_chan_timeout) where chan->conn could be freed while a timer is pending. The effective fix is to have the channel hold a reference to the associated l2cap_conn (via l2cap_conn_ge...