CVE-2026-64408

Modified Modified - Updated After Analysis

Bluetooth: bnep L2CAP Connection Pinning During Netdev Registration

Publication date: 2026-07-25

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a freed parent device. Take a reference to the L2CAP connection while holding the channel lock. Retain it until register_netdev() has taken the parent device reference.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-07-25

EPSS Evaluated

2026-11-07

NVD

CVE-2026-64408

EUVD

EUVD-2026-48952

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.11 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	7.2
linux	linux_kernel	7.2
linux	linux_kernel	From 3.13 (inc) to 5.10.261 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the Bluetooth Network Encapsulation Protocol (BNEP). The issue occurs when the bnep_add_connection function reads an L2CAP connection without proper locking, then passes the associated HCI device to register_netdev. If the controller is torn down concurrently, it can free the connection while the network device registration is still trying to use it, leading to a use-after-free scenario.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth implementation and may not have direct detection commands. Monitor kernel logs for Bluetooth-related errors or crashes, especially during network device registration. Check for kernel messages indicating issues with bnep or L2CAP connections.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service (system crash) or potentially execute arbitrary code with kernel privileges. It may lead to system instability, data corruption, or unauthorized access if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Linux kernel Bluetooth driver issue. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If updating is not immediately possible, consider disabling Bluetooth network encapsulation (bnep) if not required, or restrict Bluetooth usage to trusted devices.

Hi! I’m here to help you understand CVE-2026-64408. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...