CVE-2026-64406 addresses a use-after-free vulnerability in the Linux kernel's Bluetooth code, specifically in the bt_accept_dequeue() function. The function bt_accept_get() takes a temporary reference before releasing the accept queue lock. However, bt_accept_dequeue() drops this temporary reference before calling bt_accept_unlink(), which drops the queue reference. If the socket reference count reaches zero, a subsequent call to sock_hold() accesses freed memory, as detected by KASAN during L2CAP socket cleanup. The fix involves retaining the temporary queue-walk reference through the unlink operation and handing it to the caller on success, while explicitly dropping it on closed or not-yet-connected paths.

This vulnerability allows local attackers with access to the Bluetooth subsystem to trigger a use-after-free condition, potentially leading to memory corruption. The CVSS score of 8.0 indicates high impact with potential for confidentiality, integrity, and availability compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a kernel-level vulnerability, applying official Linux kernel updates or distribution-specific patches (e.g., from Ubuntu) when available is recommended to remediate the issue.