CVE-2026-63948

Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

State: Published
Severity: Not scored
Published: Jul 19, 2026
Updated: Jul 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

__set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold() before scheduling the delayed work. The normal path in l2cap_chan_timeout() drops this reference with l2cap_chan_put() at the end, but the early return when chan->conn is NULL skips the put, leaking the reference.

Add the missing l2cap_chan_put() before the early return.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	06acb75e7ed600d0bbf7bff5628aa8f24a97978c to before 50f1bcaaaa3a80bb1c3472044bc146e8d49d51eeAffected e97e16433eb4533083b096a3824b93a5ca3aee79 to before b5c59a5b469e2a809a2d57eda4ded94235971060Affected 8960ff650aec70485b40771cd8e6e8c4cb467d33 to before 8894c2010435a56ce7c6c2a8785860c13554df2fAffected 955b5b6c54d95b5e7444dfc81c95c8e013f27ac0 to before 63cd225cc13d782a85e2a73c04d0d350153eada1Affected adf0398cee86643b8eacde95f17d073d022f782c to before 107c826e4ef9ec5ad8f60e6fe64d8d5325ba508fAffected adf0398cee86643b8eacde95f17d073d022f782c to before e8a5baff5be273ca07771fd2b9bb1f2a4152917bAffected adf0398cee86643b8eacde95f17d073d022f782c to before 08d81fe96f80a8e20c7acb573b6a45d901fcf2cdAffected adf0398cee86643b8eacde95f17d073d022f782c to before 9dbd84990394c51f5cee1e8871bb5ff8af5ed939Affected e137e2ba96e51902dc2878131823a96bf8e638aeAffected 6466ee65e5b27161c846c73ef407f49dfa1bd1d9Affected eb86f955488c39526534211f2610e48a5cf8ead4Affected 5.10.217 to before 5.10.259Affected 5.15.159 to before 5.15.210Affected 6.1.91 to before 6.1.176Affected 6.6.31 to before 6.6.143Affected 4.19.314 to before 4.20Affected 5.4.276 to before 5.5Affected 6.8.10 to before 6.9Affected
LinuxLinux	6.9Affected before 6.9Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

06acb75e7ed600d0bbf7bff5628aa8f24a97978c to before 50f1bcaaaa3a80bb1c3472044bc146e8d49d51eeAffected
e97e16433eb4533083b096a3824b93a5ca3aee79 to before b5c59a5b469e2a809a2d57eda4ded94235971060Affected
8960ff650aec70485b40771cd8e6e8c4cb467d33 to before 8894c2010435a56ce7c6c2a8785860c13554df2fAffected
955b5b6c54d95b5e7444dfc81c95c8e013f27ac0 to before 63cd225cc13d782a85e2a73c04d0d350153eada1Affected
adf0398cee86643b8eacde95f17d073d022f782c to before 107c826e4ef9ec5ad8f60e6fe64d8d5325ba508fAffected
adf0398cee86643b8eacde95f17d073d022f782c to before e8a5baff5be273ca07771fd2b9bb1f2a4152917bAffected
adf0398cee86643b8eacde95f17d073d022f782c to before 08d81fe96f80a8e20c7acb573b6a45d901fcf2cdAffected
adf0398cee86643b8eacde95f17d073d022f782c to before 9dbd84990394c51f5cee1e8871bb5ff8af5ed939Affected
e137e2ba96e51902dc2878131823a96bf8e638aeAffected
6466ee65e5b27161c846c73ef407f49dfa1bd1d9Affected
eb86f955488c39526534211f2610e48a5cf8ead4Affected
5.10.217 to before 5.10.259Affected
5.15.159 to before 5.15.210Affected
6.1.91 to before 6.1.176Affected
6.6.31 to before 6.6.143Affected
4.19.314 to before 4.20Affected
5.4.276 to before 5.5Affected
6.8.10 to before 6.9Affected

LinuxLinux

6.9Affected
before 6.9Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.