CVE-2026-64408 describes a race condition in the Linux kernel Bluetooth network encapsulation protocol (bnep) where bnep_add_connection() accesses the L2CAP connection without proper synchronization. This allows a concurrent controller teardown to free the connection while register_netdev() is still using it, leading to a use-after-free scenario. The vulnerability was resolved by ensuring a reference to the L2CAP connection is held under the channel lock and retained until register_netdev() has taken its own reference to the parent device, preventing dereferencing freed memory.

The vulnerability could lead to a use-after-free condition during network device registration in the Bluetooth subsystem, potentially causing kernel crashes or undefined behavior. No known exploits in the wild have been reported. The impact is limited to the affected kernel Bluetooth code path and may affect system stability or security if exploited.

A fix for this vulnerability has been applied in the Linux kernel source code. Users should update to a kernel version that includes this fix. Since no specific patch links or vendor advisories are provided, check the official Linux kernel mailing lists or distribution security advisories for the patched kernel versions. Patch status is not yet confirmed in this data—verify with vendor or distribution advisories for current remediation guidance.