{"id":"CVE-2026-64557","revision":"df74df6bf48d43dc88afbc4295f0d5f0","records":[{"revision":"df74df6bf48d43dc88afbc4295f0d5f0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64557","aliases":[],"title":"Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n\nl2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after\nrelease_sock(parent). Once the parent lock is dropped the newly\nenqueued child socket sk is reachable via the accept queue, so another\ntask can accept and free it before the callback dereferences sk,\nresulting in a use-after-free.\n\nRework the ->new_connection() op so the core, rather than the callback,\nowns the child channel's lifetime. The op now receives a pre-allocated\nnew_chan and returns an errno instead of allocating and returning a\nchannel. l2cap_new_connection() allocates the child channel and links\nit into the conn list via __l2cap_chan_add() before invoking the\ncallback, so the conn-list reference keeps the channel alive once\nrelease_sock(parent) exposes the socket to other tasks.\n\nChannel configuration that was duplicated in l2cap_sock_init() and the\nvarious new_connection callbacks is consolidated into\nl2cap_chan_set_defaults(), which now inherits from the parent channel\nwhen one is supplied.","state":0,"publishedAt":"2026-07-29T08:01:47.462+00:00","modifiedAt":"2026-10-19T20:48:41.023+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/net/bluetooth/l2cap.h\",\n                        \"net/bluetooth/6lowpan.c\",\n                        \"net/bluetooth/l2cap_core.c\",\n                        \"net/bluetooth/l2cap_sock.c\",\n                        \"net/bluetooth/smp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"8ffb929098a56939ac71509302eeab5b207bf262\",\n                            \"lessThan\": \"b39298044e5534612511a2ff5de03ba5f6e7a820\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8ffb929098a56939ac71509302eeab5b207bf262\",\n                            \"lessThan\": \"8c37e4338c801ebb8cee52436c01c41e009f6e87\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8ffb929098a56939ac71509302eeab5b207bf262\",\n                            \"lessThan\": \"84e718b6a814edc84159361f9f454a4e92ae91ae\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8ffb929098a56939ac71509302eeab5b207bf262\",\n                            \"lessThan\": \"36da806f7fbaee56ad9e81859deec203f9728700\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8ffb929098a56939ac71509302eeab5b207bf262\",\n                            \"lessThan\": \"733e76e74e406c1d1ddc7369420dd8a47f48bb8a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8ffb929098a56939ac71509302eeab5b207bf262\",\n                            \"lessThan\": \"6fef032af0092ed5ccb767239a9ac1bc38c08a40\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/net/bluetooth/l2cap.h\",\n                        \"net/bluetooth/6lowpan.c\",\n                        \"net/bluetooth/l2cap_core.c\",\n                        \"net/bluetooth/l2cap_sock.c\",\n                        \"net/bluetooth/smp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.178\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.145\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.97\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.40\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.5\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/b39298044e5534612511a2ff5de03ba5f6e7a820","https://git.kernel.org/stable/c/8c37e4338c801ebb8cee52436c01c41e009f6e87","https://git.kernel.org/stable/c/84e718b6a814edc84159361f9f454a4e92ae91ae","https://git.kernel.org/stable/c/36da806f7fbaee56ad9e81859deec203f9728700","https://git.kernel.org/stable/c/733e76e74e406c1d1ddc7369420dd8a47f48bb8a","https://git.kernel.org/stable/c/6fef032af0092ed5ccb767239a9ac1bc38c08a40"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64557","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64557","identifiers":["CVE-2026-64557"]},"retained":false,"historicalAffected":[]}],"coverage":[]}