Use-After-Free Vulnerability in Linux Kernel Bluetooth Stack

CVE-2026-64557

What is CVE-2026-64557?

A vulnerability in the Linux kernel Bluetooth implementation, specifically in the L2CAP layer, can lead to a use-after-free scenario. The function l2cap_sock_new_connection_cb() improperly handles socket lifecycle management, allowing a child socket to be prematurely released while still reachable via the accept queue. This flaw can be exploited by a race condition where another task might free the socket before it is safely dereferenced, leading to potential system instability or crashes. The fix involves redesigning the connection handling to ensure proper ownership and lifecycle management of channels, preventing misuse within concurrent tasks.

References