CVE-2026-64434 - Vulnerability Details

- Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

l2cap_chan_timeout() runs asynchronously and accesses chan->conn. If
the connection is torn down while the timer is running or pending,
chan->conn can be freed, leading to a use-after-free when the timer
worker attempts to lock conn->lock:

| BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
| BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]
| BUG: KASAN: slab-use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]
| BUG: KASAN: slab-use-after-free in mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318
| Write of size 8 at addr ffff8881298d9550 by task kworker/2:1/83
|
| CPU: 2 UID: 0 PID: 83 Comm: kworker/2:1 Not tainted 7.1.0-rc6-next-20260601-dirty #6 PREEMPT(full)
| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
| Workqueue: events l2cap_chan_timeout
| Call Trace:
| <TASK>
| instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
| atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]
| __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]
| mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318
| l2cap_chan_timeout+0x5d/0x1b0 net/bluetooth/l2cap_core.c:422
| process_one_work kernel/workqueue.c:3326 [inline]
| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409
| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490
| kthread+0x346/0x430 kernel/kthread.c:436
| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158
| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
| </TASK>
|
| Allocated by task 320:
| l2cap_conn_add+0xa7/0x820 net/bluetooth/l2cap_core.c:7075
| l2cap_connect_cfm+0xdb/0xd70 net/bluetooth/l2cap_core.c:7452
| hci_connect_cfm include/net/bluetooth/hci_core.h:2139 [inline]
| hci_remote_features_evt+0x52f/0x9f0 net/bluetooth/hci_event.c:3760
| hci_event_func net/bluetooth/hci_event.c:7796 [inline]
| hci_event_packet+0x561/0xa70 net/bluetooth/hci_event.c:7847
| hci_rx_work+0x370/0x890 net/bluetooth/hci_core.c:4040
| process_one_work kernel/workqueue.c:3326 [inline]
| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409
| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490
| kthread+0x346/0x430 kernel/kthread.c:436
| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158
| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
|
| Freed by task 322:
| hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline]
| hci_conn_hash_flush+0x101/0x1f0 net/bluetooth/hci_conn.c:2736
| hci_dev_close_sync+0x889/0xde0 net/bluetooth/hci_sync.c:5405
| hci_dev_do_close net/bluetooth/hci_core.c:502 [inline]
| hci_unregister_dev+0x1f7/0x370 net/bluetooth/hci_core.c:2679
| vhci_release+0x12a/0x180 drivers/bluetooth/hci_vhci.c:690
| __fput+0x369/0x890 fs/file_table.c:510
| task_work_run+0x160/0x1d0 kernel/task_work.c:233
| get_signal+0xf5b/0x1120 kernel/signal.c:2810
| arch_do_signal_or_restart+0x4d/0x600 arch/x86/kernel/signal.c:337
| __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
| exit_to_user_mode_loop+0x85/0x510 kernel/entry/common.c:98
| do_syscall_64+0x263/0x3d0 arch/x86/entry/syscall_64.c:100
| entry_SYSCALL_64_after_hwframe+0x77/0x7f
|
| The buggy address belongs to the object at ffff8881298d9400
| which belongs to the cache kmalloc-512 of size 512
| The buggy address is located 336 bytes inside of
| freed 512-byte region [ffff8881298d9400, ffff8881298d9600)

Fix it by having chan->conn hold a reference to l2cap_conn (via
l2cap_conn_get) when the channel is added to the connection, and
releasing it in the channel destructor. This ensures the l2cap_conn
remains alive as long as the channel exists.

A new FLAG_DEL channel flag is introduced to indicate that the ch
---truncated---

Published: 2026-07-25

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug occurs in the Linux kernel’s Bluetooth L2CAP layer, where the asynchronous timeout routine can access a connection object that has already been freed, resulting in a use‑after‑free that can trigger a kernel crash or memory corruption. The vendor’s fix introduces reference counting on the connection object and a flag to keep the connection alive while channels exist.

Affected Systems

The issue appears in any Linux kernel that implements the L2CAP protocol without the reference‑counting change. The example in the description uses a 7.1.0‑rc6 kernel, but all newer kernels lacking the commit that holds a reference are affected. Affected products are Linux kernels on systems that enable Bluetooth.

Risk and Exploitability

The EPSS score is reported as less than 1%, indicating a low likelihood of current exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score is 8.8, indicating high severity. The likely attack vector is via Bluetooth communication that causes a channel timeout while the underlying connection is torn down. Based on the description, it is inferred that an attacker trigger the fault by manipulating Bluetooth connections to induce the timeout condition.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`89dec92041717b027216e110599e4f6d6c921b79`	affected	< 91047a4396a8b1857a6f712a90cf33ec0012b189
`50dfec218808b148ab4247b1858031b7a32015c5`	affected	< 0b0e2bf39cf99e458d991b9df253727e036a7d7d
`859d3ace791ed878ae9ba5522c7844d960da8f88`	affected	< d3b739db5dc6f688a60d56da872fabaf65246032
`8c8e620467a7b51562dbcefbd1f09f288d7d710d`	affected	< 50c38d9f42a529691e4e67ea9cedf4f0bfc8d277
`8c8e620467a7b51562dbcefbd1f09f288d7d710d`	affected	< b66774b48dd98f07254951f74ea6f513efe7ff8b
`3634cbdc2eb414b69ffa752ddbe5e0458518e321`	affected	—
`e1c100e2d61bd8c718b7d91fe3e050780a9bf72d`	affected	—
`deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9`	affected	—
`7555fd885a0603f50e49a655850a1f2bd8a25398`	affected	—
`6.6.143`	affected	< 6.6.145
`6.12.93`	affected	< 6.12.97
`6.18.35`	affected	< 6.18.39
`5.10.259`	affected	< 5.11
`5.15.210`	affected	< 5.16
`6.1.176`	affected	< 6.2
`7.0.12`	affected	< 7.1

Linux

affected

Version	Status	Constraints
`7.1`	affected	—
`0`	unaffected	< 7.1
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[89dec92041717b027216e110599e4f6d6c921b79,91047a4396a8b1857a6f712a90cf33ec0012b189)`	affected	code_commit	—
`[50dfec218808b148ab4247b1858031b7a32015c5,0b0e2bf39cf99e458d991b9df253727e036a7d7d)`	affected	code_commit	—
`[859d3ace791ed878ae9ba5522c7844d960da8f88,d3b739db5dc6f688a60d56da872fabaf65246032)`	affected	code_commit	—
`[8c8e620467a7b51562dbcefbd1f09f288d7d710d,50c38d9f42a529691e4e67ea9cedf4f0bfc8d277)`	affected	code_commit	—
`[8c8e620467a7b51562dbcefbd1f09f288d7d710d,b66774b48dd98f07254951f74ea6f513efe7ff8b)`	affected	code_commit	—
`[3634cbdc2eb414b69ffa752ddbe5e0458518e321,*`	affected	code_commit	—
`[e1c100e2d61bd8c718b7d91fe3e050780a9bf72d,*`	affected	code_commit	—
`[deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9,*`	affected	code_commit	—
`[7555fd885a0603f50e49a655850a1f2bd8a25398,*`	affected	code_commit	—
`[6.6.143,6.6.145)`	affected	semver	—
`[6.12.93,6.12.97)`	affected	semver	—
`[6.18.35,6.18.39)`	affected	semver	—
`[5.10.259,5.11)`	affected	semver	—
`[5.15.210,5.16)`	affected	semver	—
`[6.1.176,6.2)`	affected	semver	—
`[7.0.12,7.1)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7.1,*)`	affected	semver	—
`[0,7.1)`	unaffected	semver	—
`[6.6.145,6.6.*]`	unaffected	semver	—
`[6.12.97,6.12.*]`	unaffected	semver	—
`[6.18.39,6.18.*]`	unaffected	semver	—
`[7.1.4,7.1.*]`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a Linux kernel version that includes the L2CAP reference‑counting patch.
If an upgrade cannot be performed immediately, disable or unbind the Bluetooth L2CAP module or turn off Bluetooth services to eliminate the attack surface.
Continuously monitor kernel logs (dmesg, /var/log/kern.log) for KASAN or oops messages that indicate a use‑after‑free in the L2CAP code.

Generated by OpenCVE AI on August 2, 2026 at 12:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4724-1	linux-6.12 new package
Debian DSA	DSA-6405-1	linux security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00247.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0b0e2bf39cf99e458d991b9df253727e036a7d7d
https://git.kernel.org/stable/c/50c38d9f42a529691e4e67ea9cedf4f0bfc8d277
https://git.kernel.org/stable/c/91047a4396a8b1857a6f712a90cf33ec0012b189
https://git.kernel.org/stable/c/b66774b48dd98f07254951f74ea6f513efe7ff8b
https://git.kernel.org/stable/c/d3b739db5dc6f688a60d56da872fabaf65246032
https://lore.kernel.org/linux-cve-announce/2026072537-CVE-2026-64434-91cc@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64434
https://www.cve.org/CVERecord?id=CVE-2026-64434

History

Sat, 01 Aug 2026 02:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Thu, 30 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-364
References		https://lore.kernel.org/linux-cve-announce/2026072537-CVE-2026-64434-91cc@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64434 https://www.cve.org/CVERecord?id=CVE-2026-64434
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 27 Jul 2026 05:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2cap_chan_timeout() runs asynchronously and accesses chan->conn. If the connection is torn down while the timer is running or pending, chan->conn can be freed, leading to a use-after-free when the timer worker attempts to lock conn->lock: \| BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] \| BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline] \| BUG: KASAN: slab-use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:161 [inline] \| BUG: KASAN: slab-use-after-free in mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318 \| Write of size 8 at addr ffff8881298d9550 by task kworker/2:1/83 \| \| CPU: 2 UID: 0 PID: 83 Comm: kworker/2:1 Not tainted 7.1.0-rc6-next-20260601-dirty #6 PREEMPT(full) \| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 \| Workqueue: events l2cap_chan_timeout \| Call Trace: \| <TASK> \| instrument_atomic_read_write include/linux/instrumented.h:112 [inline] \| atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline] \| __mutex_trylock_fast kernel/locking/mutex.c:161 [inline] \| mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318 \| l2cap_chan_timeout+0x5d/0x1b0 net/bluetooth/l2cap_core.c:422 \| process_one_work kernel/workqueue.c:3326 [inline] \| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409 \| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490 \| kthread+0x346/0x430 kernel/kthread.c:436 \| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158 \| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 \| </TASK> \| \| Allocated by task 320: \| l2cap_conn_add+0xa7/0x820 net/bluetooth/l2cap_core.c:7075 \| l2cap_connect_cfm+0xdb/0xd70 net/bluetooth/l2cap_core.c:7452 \| hci_connect_cfm include/net/bluetooth/hci_core.h:2139 [inline] \| hci_remote_features_evt+0x52f/0x9f0 net/bluetooth/hci_event.c:3760 \| hci_event_func net/bluetooth/hci_event.c:7796 [inline] \| hci_event_packet+0x561/0xa70 net/bluetooth/hci_event.c:7847 \| hci_rx_work+0x370/0x890 net/bluetooth/hci_core.c:4040 \| process_one_work kernel/workqueue.c:3326 [inline] \| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409 \| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490 \| kthread+0x346/0x430 kernel/kthread.c:436 \| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158 \| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 \| \| Freed by task 322: \| hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline] \| hci_conn_hash_flush+0x101/0x1f0 net/bluetooth/hci_conn.c:2736 \| hci_dev_close_sync+0x889/0xde0 net/bluetooth/hci_sync.c:5405 \| hci_dev_do_close net/bluetooth/hci_core.c:502 [inline] \| hci_unregister_dev+0x1f7/0x370 net/bluetooth/hci_core.c:2679 \| vhci_release+0x12a/0x180 drivers/bluetooth/hci_vhci.c:690 \| __fput+0x369/0x890 fs/file_table.c:510 \| task_work_run+0x160/0x1d0 kernel/task_work.c:233 \| get_signal+0xf5b/0x1120 kernel/signal.c:2810 \| arch_do_signal_or_restart+0x4d/0x600 arch/x86/kernel/signal.c:337 \| __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] \| exit_to_user_mode_loop+0x85/0x510 kernel/entry/common.c:98 \| do_syscall_64+0x263/0x3d0 arch/x86/entry/syscall_64.c:100 \| entry_SYSCALL_64_after_hwframe+0x77/0x7f \| \| The buggy address belongs to the object at ffff8881298d9400 \| which belongs to the cache kmalloc-512 of size 512 \| The buggy address is located 336 bytes inside of \| freed 512-byte region [ffff8881298d9400, ffff8881298d9600) Fix it by having chan->conn hold a reference to l2cap_conn (via l2cap_conn_get) when the channel is added to the connection, and releasing it in the channel destructor. This ensures the l2cap_conn remains alive as long as the channel exists. A new FLAG_DEL channel flag is introduced to indicate that the ch ---truncated---
Title		Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b0e2bf39cf99e458d991b9df253727e036a7d7d https://git.kernel.org/stable/c/50c38d9f42a529691e4e67ea9cedf4f0bfc8d277 https://git.kernel.org/stable/c/91047a4396a8b1857a6f712a90cf33ec0012b189 https://git.kernel.org/stable/c/b66774b48dd98f07254951f74ea6f513efe7ff8b https://git.kernel.org/stable/c/d3b739db5dc6f688a60d56da872fabaf65246032

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:51:09.066Z

Updated: 2026-08-05T12:41:57.766Z

Reserved: 2026-07-19T15:36:31.787Z

Link: CVE-2026-64434

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:27.717

Modified: 2026-08-11T15:01:50.637

Link: CVE-2026-64434

Redhat

Severity : Important

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64434 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-02T12:45:06Z

Weaknesses

CWE-364
Signal Handler Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object