VulnerabilityPublished 15 Aug 2026Updated 30 Oct 2026

CVE-2026-72336: Linux kernel · Bluetooth: 6lowpan: hold L2CAP conn across debugfs control

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in d2a8dc1f619c9e0e4126bee795c39ebddd2ec8ff : patch Linux kernel soon.

Data as of 30 Oct 2026, 13:20 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in d2a8dc1f619c9e0e4126bee795c39ebddd2ec8ff, ba1f1ef6522e63aa5dd29805b4390ea2ccadf05e, 518aa9505fa10ea5662349e5d2efd8c9e32a820b +3

Exploitation evidence

Disclosed: evidence found.
CVE published 15 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 6b8d4a6a03144c5996f98db7f8256267b0d72a3a, < d2a8dc1f619c9e0e4126bee795c39ebddd2ec8ff	Fixed in d2a8dc1f619c9e0e4126bee795c39ebddd2ec8ff
LinuxLinux	Affected ≥ 6b8d4a6a03144c5996f98db7f8256267b0d72a3a, < ba1f1ef6522e63aa5dd29805b4390ea2ccadf05e	Fixed in ba1f1ef6522e63aa5dd29805b4390ea2ccadf05e
LinuxLinux	Affected ≥ 6b8d4a6a03144c5996f98db7f8256267b0d72a3a, < 518aa9505fa10ea5662349e5d2efd8c9e32a820b	Fixed in 518aa9505fa10ea5662349e5d2efd8c9e32a820b
LinuxLinux	Affected ≥ 6b8d4a6a03144c5996f98db7f8256267b0d72a3a, < 32c48c7f6cc8c7888e46a8c81622154ccafda5d2	Fixed in 32c48c7f6cc8c7888e46a8c81622154ccafda5d2
LinuxLinux	Affected ≥ 6b8d4a6a03144c5996f98db7f8256267b0d72a3a, < 23a83bac3356e7b211bcdcf581a31f7b536a2c24	Fixed in 23a83bac3356e7b211bcdcf581a31f7b536a2c24
LinuxLinux	Affected ≥ 6b8d4a6a03144c5996f98db7f8256267b0d72a3a, < 1df008a0770843caaeb7148705fc104bfb266630	Fixed in 1df008a0770843caaeb7148705fc104bfb266630

AI-suggested

The vulnerability has been fixed in the Linux kernel as indicated by the listed fixed commit hashes. Users and administrators should update their Linux kernel to a version including these fixes to remediate the issue. No additional mitigation is required beyond applying the official patch.

Description

CVE-2026-72336 is a use-after-free vulnerability in the Linux kernel's Bluetooth 6LoWPAN implementation. It occurs due to improper handling of L2CAP connection references across debugfs control operations, allowing a race condition where a connection can be freed while still in use. This flaw was identified through kernel address sanitizer (KASAN) reports and has been fixed in specific Linux kernel commits.

Impact

This vulnerability can cause a kernel use-after-free condition, potentially leading to kernel crashes or memory corruption. While no public exploit or in-the-wild exploitation is reported, successful exploitation could affect system stability and security by allowing attackers to trigger kernel memory errors.

Summary

The vulnerability involves the get_l2cap_conn() function which looks up an LE hci_conn under hdev protection but drops that protection before accessing l2cap_data. This creates a race window where a disconnect or device close can tear down the L2CAP connection while it is still being accessed, leading to a use-after-free condition. The fix involves taking a reference to the L2CAP connection while hdev is locked and dropping it only after the debugfs command finishes using the connection, preventing the connection from being dereferenced after it is freed. The issue was validated by reproducing a KASAN slab-use-after-free error in lowpan_control_write().

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Oct 2026, 13:20 UTC

Technical details

References

Community reviews

Related threats