{"id":"CVE-2026-64434","revision":null,"records":[{"revision":"61c01c633779438492c21c2bf5ed0720","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64434","aliases":[],"title":"Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\n\nl2cap_chan_timeout() runs asynchronously and accesses chan->conn. If\nthe connection is torn down while the timer is running or pending,\nchan->conn can be freed, leading to a use-after-free when the timer\nworker attempts to lock conn->lock:\n\n| BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]\n| BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]\n| BUG: KASAN: slab-use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]\n| BUG: KASAN: slab-use-after-free in mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318\n| Write of size 8 at addr ffff8881298d9550 by task kworker/2:1/83\n|\n| CPU: 2 UID: 0 PID: 83 Comm: kworker/2:1 Not tainted 7.1.0-rc6-next-20260601-dirty #6 PREEMPT(full)\n| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\n| Workqueue: events l2cap_chan_timeout\n| Call Trace:\n| \n| instrument_atomic_read_write include/linux/instrumented.h:112 [inline]\n| atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]\n| __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]\n| mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318\n| l2cap_chan_timeout+0x5d/0x1b0 net/bluetooth/l2cap_core.c:422\n| process_one_work kernel/workqueue.c:3326 [inline]\n| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409\n| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490\n| kthread+0x346/0x430 kernel/kthread.c:436\n| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158\n| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n| \n|\n| Allocated by task 320:\n| l2cap_conn_add+0xa7/0x820 net/bluetooth/l2cap_core.c:7075\n| l2cap_connect_cfm+0xdb/0xd70 net/bluetooth/l2cap_core.c:7452\n| hci_connect_cfm include/net/bluetooth/hci_core.h:2139 [inline]\n| hci_remote_features_evt+0x52f/0x9f0 net/bluetooth/hci_event.c:3760\n| hci_event_func net/bluetooth/hci_event.c:7796 [inline]\n| hci_event_packet+0x561/0xa70 net/bluetooth/hci_event.c:7847\n| hci_rx_work+0x370/0x890 net/bluetooth/hci_core.c:4040\n| process_one_work kernel/workqueue.c:3326 [inline]\n| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409\n| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490\n| kthread+0x346/0x430 kernel/kthread.c:436\n| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158\n| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n|\n| Freed by task 322:\n| hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline]\n| hci_conn_hash_flush+0x101/0x1f0 net/bluetooth/hci_conn.c:2736\n| hci_dev_close_sync+0x889/0xde0 net/bluetooth/hci_sync.c:5405\n| hci_dev_do_close net/bluetooth/hci_core.c:502 [inline]\n| hci_unregister_dev+0x1f7/0x370 net/bluetooth/hci_core.c:2679\n| vhci_release+0x12a/0x180 drivers/bluetooth/hci_vhci.c:690\n| __fput+0x369/0x890 fs/file_table.c:510\n| task_work_run+0x160/0x1d0 kernel/task_work.c:233\n| get_signal+0xf5b/0x1120 kernel/signal.c:2810\n| arch_do_signal_or_restart+0x4d/0x600 arch/x86/kernel/signal.c:337\n| __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]\n| exit_to_user_mode_loop+0x85/0x510 kernel/entry/common.c:98\n| do_syscall_64+0x263/0x3d0 arch/x86/entry/syscall_64.c:100\n| entry_SYSCALL_64_after_hwframe+0x77/0x7f\n|\n| The buggy address belongs to the object at ffff8881298d9400\n| which belongs to the cache kmalloc-512 of size 512\n| The buggy address is located 336 bytes inside of\n| freed 512-byte region [ffff8881298d9400, ffff8881298d9600)\n\nFix it by having chan->conn hold a reference to l2cap_conn (via\nl2cap_conn_get) when the channel is added to the connection, and\nreleasing it in the channel destructor. This ensures the l2cap_conn\nremains alive as long as the channel exists.\n\nA new FLAG_DEL channel flag is introduced to indicate that the ch\n---truncated---","state":0,"publishedAt":"2026-07-25T08:51:09.066+00:00","modifiedAt":"2026-10-19T20:38:28.58+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"include/net/bluetooth/l2cap.h\",\n \"net/bluetooth/l2cap_core.c\"\n ],\n \"versions\": [\n {\n \"version\": \"3634cbdc2eb414b69ffa752ddbe5e0458518e321\",\n \"lessThan\": \"8f90405a4a6f1f1880dc07996b47bf57c712bd8a\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"e1c100e2d61bd8c718b7d91fe3e050780a9bf72d\",\n \"lessThan\": \"32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9\",\n \"lessThan\": \"8922c7940bae9ce4b1736dddb6362370793835c2\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"89dec92041717b027216e110599e4f6d6c921b79\",\n \"lessThan\": \"91047a4396a8b1857a6f712a90cf33ec0012b189\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"50dfec218808b148ab4247b1858031b7a32015c5\",\n \"lessThan\": \"0b0e2bf39cf99e458d991b9df253727e036a7d7d\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"859d3ace791ed878ae9ba5522c7844d960da8f88\",\n \"lessThan\": \"d3b739db5dc6f688a60d56da872fabaf65246032\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"8c8e620467a7b51562dbcefbd1f09f288d7d710d\",\n \"lessThan\": \"50c38d9f42a529691e4e67ea9cedf4f0bfc8d277\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"8c8e620467a7b51562dbcefbd1f09f288d7d710d\",\n \"lessThan\": \"b66774b48dd98f07254951f74ea6f513efe7ff8b\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"7555fd885a0603f50e49a655850a1f2bd8a25398\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"5.10.259\",\n \"lessThan\": \"5.10.265\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.210\",\n \"lessThan\": \"5.15.216\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.176\",\n \"lessThan\": \"6.1.183\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.143\",\n \"lessThan\": \"6.6.145\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.93\",\n \"lessThan\": \"6.12.97\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.35\",\n \"lessThan\": \"6.18.39\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.0.12\",\n \"lessThan\": \"7.1\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"include/net/bluetooth/l2cap.h\",\n \"net/bluetooth/l2cap_core.c\"\n ],\n \"versions\": [\n {\n \"version\": \"7.1\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"7.1\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.265\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.216\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.183\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.145\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.97\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.39\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.1.4\",\n \"lessThanOrEqual\": \"7.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.2\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/8f90405a4a6f1f1880dc07996b47bf57c712bd8a","https://git.kernel.org/stable/c/32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b","https://git.kernel.org/stable/c/8922c7940bae9ce4b1736dddb6362370793835c2","https://git.kernel.org/stable/c/91047a4396a8b1857a6f712a90cf33ec0012b189","https://git.kernel.org/stable/c/0b0e2bf39cf99e458d991b9df253727e036a7d7d","https://git.kernel.org/stable/c/d3b739db5dc6f688a60d56da872fabaf65246032","https://git.kernel.org/stable/c/50c38d9f42a529691e4e67ea9cedf4f0bfc8d277","https://git.kernel.org/stable/c/b66774b48dd98f07254951f74ea6f513efe7ff8b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64434","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64434","identifiers":["CVE-2026-64434"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T16:11:32.8669692+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T16:11:32.8669692+00:00","lastSuccessAt":"2026-11-08T16:11:33.0663673+00:00","error":null,"lastVerifiedAt":"2026-11-08T16:11:33.0663692+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-8efc3185ca756d5b7422ffb0b03b28efb013f2613f9dfca00a2fb41576507917","complete":true,"records":421174,"lastAttemptAt":"2026-11-08T16:11:31.8941159+00:00","lastSuccessAt":"2026-11-08T16:11:31.6860236+00:00","error":null,"lastVerifiedAt":"2026-11-08T16:11:31.8941159+00:00","snapshotPublishedAt":"2026-11-08T15:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-3c4bbd4ca5ed46108ac75e394fa48ace","complete":true,"records":13654,"lastAttemptAt":"2026-11-08T16:11:35.9510843+00:00","lastSuccessAt":"2026-11-08T16:11:35.947+00:00","error":null,"lastVerifiedAt":"2026-11-08T16:11:35.947+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T16:11:32.8669692+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T16:11:32.8669692+00:00","lastSuccessAt":"2026-11-08T16:11:33.0716184+00:00","error":null,"lastVerifiedAt":"2026-11-08T16:11:33.0716198+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-7f3b9e580ebe475bb44f224af7ef38ba","complete":true,"records":13666,"lastAttemptAt":"2026-11-08T16:11:35.0811636+00:00","lastSuccessAt":"2026-11-08T16:11:35.077+00:00","error":null,"lastVerifiedAt":"2026-11-08T16:11:35.077+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T16:11:32.7092062+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-08T16:11:32.7092062+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T16:11:32.0361288+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T16:11:32.0361288+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-964c14035e6f0f6478b2870fad6a7ef9f6045876d4a12af2c2e514521e54b6af","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T16:11:32.8190262+00:00","lastSuccessAt":"2026-11-08T11:07:12.1927025+00:00","error":null,"lastVerifiedAt":"2026-11-08T16:11:32.8190262+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T16:11:32.2222906+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-08T16:11:32.2222906+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}