In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn… (CVE-2026-63948)
A reference leak vulnerability in the Linux kernel's Bluetooth L2CAP implementation was fixed. The issue occurs in the l2cap_chan_timeout() function where an early return path skips releasing a reference, causing a resource leak. The fix adds the missing reference release call to prevent the leak.
AI Analysis
Technical Summary
The Linux kernel's Bluetooth L2CAP code had a flaw in the l2cap_chan_timeout() function where a reference to a channel (l2cap_chan) was held via l2cap_chan_hold() before scheduling delayed work. Normally, this reference is released with l2cap_chan_put() at the end of the function. However, if the channel's connection pointer (chan->conn) is NULL, an early return path skips the release, causing a reference leak. The patch adds the missing l2cap_chan_put() call before this early return to fix the leak.
Potential Impact
This vulnerability causes a reference leak in the Bluetooth L2CAP channel handling code, which may lead to resource exhaustion or degraded system stability over time. There is no indication of direct code execution or privilege escalation from this leak. No known exploits are reported in the wild.
Mitigation Recommendations
A fix for this vulnerability has been applied in the Linux kernel source code. Users should update their Linux kernel to a version that includes this patch to resolve the reference leak. Since no vendor advisory or patch links are provided, check the official Linux kernel repositories or distributions for the updated kernel versions containing this fix.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn… (CVE-2026-63948)
Description
A reference leak vulnerability in the Linux kernel's Bluetooth L2CAP implementation was fixed. The issue occurs in the l2cap_chan_timeout() function where an early return path skips releasing a reference, causing a resource leak. The fix adds the missing reference release call to prevent the leak.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's Bluetooth L2CAP code had a flaw in the l2cap_chan_timeout() function where a reference to a channel (l2cap_chan) was held via l2cap_chan_hold() before scheduling delayed work. Normally, this reference is released with l2cap_chan_put() at the end of the function. However, if the channel's connection pointer (chan->conn) is NULL, an early return path skips the release, causing a reference leak. The patch adds the missing l2cap_chan_put() call before this early return to fix the leak.
Potential Impact
This vulnerability causes a reference leak in the Bluetooth L2CAP channel handling code, which may lead to resource exhaustion or degraded system stability over time. There is no indication of direct code execution or privilege escalation from this leak. No known exploits are reported in the wild.
Mitigation Recommendations
A fix for this vulnerability has been applied in the Linux kernel source code. Users should update their Linux kernel to a version that includes this patch to resolve the reference leak. Since no vendor advisory or patch links are provided, check the official Linux kernel repositories or distributions for the updated kernel versions containing this fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jg7r-p8w6-9pmq
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63948"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27aa2a4a8d598912e8a2
Added to database: 07/19/2026, 19:38:18 UTC
Last enriched: 07/19/2026, 20:04:52 UTC
Last updated: 07/20/2026, 17:26:47 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.