In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during…
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:13 UTC
No CVSS score from NVD or the CNA
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix for this vulnerability has been applied in the Linux kernel source code. Users should update to a kernel version that includes this fix. Since no specific patch links or vendor advisories are provided, check the official Linux kernel mailing lists or distribution security advisories for the patched kernel versions.
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a freed parent device. Take a reference to the L2CAP connection while holding the channel lock. Retain it until register_netdev() has taken the parent device reference.
Impact
The vulnerability could lead to a use-after-free condition during network device registration in the Bluetooth subsystem, potentially causing kernel crashes or undefined behavior. No known exploits in the wild have been reported. The impact is limited to the affected kernel Bluetooth code path and may affect system stability or security if exploited.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64408 (opens in a new tab)
- git.kernel.org/stable/c/390b5db3ff8745187f094c4e915663b7b1f98944 (opens in a new tab)
- git.kernel.org/stable/c/46a88784c4c9b96954dd86f747ce93f65efa1302 (opens in a new tab)
- git.kernel.org/stable/c/551ae773ec64045b4e72099132654887e0270bcc (opens in a new tab)
- git.kernel.org/stable/c/563a8573047182f550b1e1e030615755cd8c41da (opens in a new tab)
- git.kernel.org/stable/c/a6b22dbd80926556290ad2243be25218d6956a19 (opens in a new tab)
- git.kernel.org/stable/c/ae215c5b6422d8eda443b861b124bd1be6969c31 (opens in a new tab)
- git.kernel.org/stable/c/bb067a99a0356196c0b89a95721985485ebce5a5 (opens in a new tab)
- git.kernel.org/stable/c/df22adc7eafc22e651561813c11dc51a796b12ee (opens in a new tab)