In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()… (CVE-2026-64557)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after release_sock(parent). Once the parent lock is dropped the newly enqueued child socket sk is reachable via the accept queue, so another task can accept and free it before the callback dereferences sk, resulting in a use-after-free. Rework the ->new_connection() op so the core, rather than the callback, owns the child channel's lifetime. The op now receives a pre-allocated new_chan and returns an errno instead of allocating and returning a channel. l2cap_new_connection() allocates the child channel and links it into the conn list via __l2cap_chan_add() before invoking the callback, so the conn-list reference keeps the channel alive once release_sock(parent) exposes the socket to other tasks. Channel configuration that was duplicated in l2cap_sock_init() and the various new_connection callbacks is consolidated into l2cap_chan_set_defaults(), which now inherits from the parent channel when one is supplied.
AI Analysis
Technical Summary
CVE-2026-64557 is a use-after-free vulnerability in the Linux kernel Bluetooth L2CAP layer. The vulnerable function l2cap_sock_new_connection_cb() returned a pointer to a channel after releasing the parent socket lock. Because the child socket becomes reachable via the accept queue once the parent lock is dropped, another task could accept and free the socket before the callback dereferenced it, causing a use-after-free. The fix changes the new_connection operation so the core manages the child channel's lifetime by pre-allocating the channel and linking it into the connection list before invoking the callback. This ensures the channel remains valid even after the parent socket lock is released. Additionally, channel configuration code was consolidated into a single function to reduce duplication.
Potential Impact
Successful exploitation could allow an attacker with local access to cause use-after-free conditions in the Bluetooth L2CAP code, potentially leading to memory corruption with high impact on confidentiality, integrity, and availability of the system. The CVSS vector indicates the attack requires adjacent network access with low complexity and no privileges or user interaction, and results in high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available and has been applied to the Linux kernel to address this vulnerability. Users and administrators should update to the latest kernel version containing this patch. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation. No additional mitigations are specified.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()… (CVE-2026-64557)
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after release_sock(parent). Once the parent lock is dropped the newly enqueued child socket sk is reachable via the accept queue, so another task can accept and free it before the callback dereferences sk, resulting in a use-after-free. Rework the ->new_connection() op so the core, rather than the callback, owns the child channel's lifetime. The op now receives a pre-allocated new_chan and returns an errno instead of allocating and returning a channel. l2cap_new_connection() allocates the child channel and links it into the conn list via __l2cap_chan_add() before invoking the callback, so the conn-list reference keeps the channel alive once release_sock(parent) exposes the socket to other tasks. Channel configuration that was duplicated in l2cap_sock_init() and the various new_connection callbacks is consolidated into l2cap_chan_set_defaults(), which now inherits from the parent channel when one is supplied.
CVSS v3.1
Score 8.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-64557 is a use-after-free vulnerability in the Linux kernel Bluetooth L2CAP layer. The vulnerable function l2cap_sock_new_connection_cb() returned a pointer to a channel after releasing the parent socket lock. Because the child socket becomes reachable via the accept queue once the parent lock is dropped, another task could accept and free the socket before the callback dereferenced it, causing a use-after-free. The fix changes the new_connection operation so the core manages the child channel's lifetime by pre-allocating the channel and linking it into the connection list before invoking the callback. This ensures the channel remains valid even after the parent socket lock is released. Additionally, channel configuration code was consolidated into a single function to reduce duplication.
Potential Impact
Successful exploitation could allow an attacker with local access to cause use-after-free conditions in the Bluetooth L2CAP code, potentially leading to memory corruption with high impact on confidentiality, integrity, and availability of the system. The CVSS vector indicates the attack requires adjacent network access with low complexity and no privileges or user interaction, and results in high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available and has been applied to the Linux kernel to address this vulnerability. Users and administrators should update to the latest kernel version containing this patch. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation. No additional mitigations are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-57gr-rx4p-h42m
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64557"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72cf9c2644c7f84768b8
Added to database: 07/30/2026, 15:50:39 UTC
Last enriched: 07/30/2026, 19:28:06 UTC
Last updated: 07/31/2026, 19:30:15 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.