CVE-2026-64434 is a use-after-free vulnerability in the Linux kernel Bluetooth L2CAP subsystem. The asynchronous l2cap_chan_timeout() function accesses chan->conn without holding a reference, leading to use-after-free if the connection is torn down during the timer's pending period. This results in kernel memory corruption detected by KASAN and can cause system instability or compromise. The issue affects Linux kernel versions prior to 7.0.0-31.31 and related variants. The vulnerability has a CVSS 3.1 score of 8.8 (high severity) with network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Ubuntu has released patched kernel versions to address this flaw.

Successful exploitation of this use-after-free vulnerability can lead to kernel memory corruption, potentially allowing an attacker to escalate privileges, cause denial of service, or execute arbitrary code within the kernel context. The CVSS score of 8.8 indicates a high impact on confidentiality, integrity, and availability of affected systems. However, no known exploits in the wild have been reported at this time.

A patch is available and has been released by Ubuntu in updated Linux kernel packages. Users should update their systems to the fixed kernel versions and reboot to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow the vendor advisory instructions for updating to the specified package versions to fully remediate the vulnerability.