In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref… (CVE-2026-64434)
A use-after-free vulnerability was identified and resolved in the Linux kernel's Bluetooth L2CAP implementation. The issue occurs because the asynchronous l2cap_chan_timeout() function accesses a connection object that may have been freed if the connection is torn down while the timer is pending. This can lead to a use-after-free condition when the timer worker attempts to lock the freed connection's mutex. The fix involves holding a reference to the connection object for the lifetime of the channel to prevent premature freeing.
AI Analysis
Technical Summary
The Linux kernel Bluetooth L2CAP subsystem had a use-after-free vulnerability (CVE-2026-64434) caused by l2cap_chan_timeout() accessing chan->conn asynchronously. If the connection is torn down while the timer is active or pending, chan->conn can be freed, leading to a use-after-free when the timer worker tries to lock conn->lock. The issue was detected by KASAN reports showing slab-use-after-free errors in mutex_lock and related kernel functions. The vulnerability was fixed by ensuring the channel holds a reference to the connection object via l2cap_conn_get when added, and releasing it in the channel destructor, preventing the connection from being freed while the channel exists.
Potential Impact
This vulnerability can cause use-after-free memory corruption in the kernel Bluetooth stack, potentially leading to kernel crashes or undefined behavior. No known exploits in the wild have been reported. The impact is limited to systems using the affected Linux kernel Bluetooth L2CAP implementation.
Mitigation Recommendations
A fix is available and has been applied in the Linux kernel source to hold a reference to the connection object for the lifetime of the channel, preventing the use-after-free. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref… (CVE-2026-64434)
Description
A use-after-free vulnerability was identified and resolved in the Linux kernel's Bluetooth L2CAP implementation. The issue occurs because the asynchronous l2cap_chan_timeout() function accesses a connection object that may have been freed if the connection is torn down while the timer is pending. This can lead to a use-after-free condition when the timer worker attempts to lock the freed connection's mutex. The fix involves holding a reference to the connection object for the lifetime of the channel to prevent premature freeing.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel Bluetooth L2CAP subsystem had a use-after-free vulnerability (CVE-2026-64434) caused by l2cap_chan_timeout() accessing chan->conn asynchronously. If the connection is torn down while the timer is active or pending, chan->conn can be freed, leading to a use-after-free when the timer worker tries to lock conn->lock. The issue was detected by KASAN reports showing slab-use-after-free errors in mutex_lock and related kernel functions. The vulnerability was fixed by ensuring the channel holds a reference to the connection object via l2cap_conn_get when added, and releasing it in the channel destructor, preventing the connection from being freed while the channel exists.
Potential Impact
This vulnerability can cause use-after-free memory corruption in the kernel Bluetooth stack, potentially leading to kernel crashes or undefined behavior. No known exploits in the wild have been reported. The impact is limited to systems using the affected Linux kernel Bluetooth L2CAP implementation.
Mitigation Recommendations
A fix is available and has been applied in the Linux kernel source to hold a reference to the connection object for the lifetime of the channel, preventing the use-after-free. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9wm7-g2v6-vprf
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64434"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6542099c2644c7f80838a3
Added to database: 07/25/2026, 23:08:57 UTC
Last enriched: 07/25/2026, 23:24:03 UTC
Last updated: 07/26/2026, 03:51:54 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.