CVE-2026-64406 describes a use-after-free vulnerability in the Linux kernel Bluetooth code, specifically in the bt_accept_dequeue() and bt_accept_get() functions. The vulnerability arises because bt_accept_get() takes a temporary reference before releasing the accept queue lock, but bt_accept_dequeue() drops this reference before calling bt_accept_unlink(), which drops the queue reference. If the queue reference was the final one, subsequent sock_hold() calls access freed memory, causing a use-after-free condition. The issue was identified by KASAN during socket cleanup for listening L2CAP sockets. The patch retains the temporary queue-walk reference through unlink and ensures it is properly managed on success or dropped on closed/not-connected paths.

This vulnerability can lead to use-after-free memory access in the Bluetooth subsystem of the Linux kernel, potentially causing kernel crashes or undefined behavior. There is no evidence of known exploits in the wild. The impact is limited to affected kernel Bluetooth socket operations during connection handling and cleanup.

A fix has been implemented to address this vulnerability by retaining the temporary reference correctly and managing its lifecycle properly. Since this is a Linux kernel vulnerability, applying the official kernel patches that include this fix is recommended. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisories for the current remediation guidance.