CVE-2026-64557

Received Received - Intake

Use-After-Free in Linux Kernel Bluetooth L2CAP

Publication date: 2026-07-29

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after release_sock(parent). Once the parent lock is dropped the newly enqueued child socket sk is reachable via the accept queue, so another task can accept and free it before the callback dereferences sk, resulting in a use-after-free. Rework the ->new_connection() op so the core, rather than the callback, owns the child channel's lifetime. The op now receives a pre-allocated new_chan and returns an errno instead of allocating and returning a channel. l2cap_new_connection() allocates the child channel and links it into the conn list via __l2cap_chan_add() before invoking the callback, so the conn-list reference keeps the channel alive once release_sock(parent) exposes the socket to other tasks. Channel configuration that was duplicated in l2cap_sock_init() and the various new_connection callbacks is consolidated into l2cap_chan_set_defaults(), which now inherits from the parent channel when one is supplied.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-17

NVD

CVE-2026-64557

EUVD

EUVD-2026-50202

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's Bluetooth L2CAP implementation. It occurs when l2cap_sock_new_connection_cb() returns a channel pointer after releasing a parent lock, allowing another task to free the socket before the callback uses it. The fix reworks the connection callback to let the core manage the channel's lifetime, preventing premature access.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth L2CAP implementation and may not have direct network detection commands. Monitor kernel logs for Bluetooth-related crashes or use-after-free errors using dmesg or journalctl. Check for kernel version and Bluetooth stack updates.

Impact Analysis

An attacker within Bluetooth range could exploit this to cause a denial-of-service (system crash) or potentially execute arbitrary code with kernel privileges. This requires proximity but no authentication, affecting systems with vulnerable Linux kernels.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's Bluetooth L2CAP implementation. It could potentially allow unauthorized access or data corruption if exploited, which may impact compliance with standards requiring data integrity and secure communication channels like GDPR or HIPAA. However, specific compliance impacts depend on system configuration and deployment context.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-64557. Disable Bluetooth functionality if not required. Apply kernel patches promptly as this is a use-after-free issue with high severity.

Hi! I’m here to help you understand CVE-2026-64557. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70