CVE-2026-64408

Bluetooth: bnep: pin L2CAP connection during netdev registration

State: Published
Severity: 8.8 High
Published: Jul 25, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bnep: pin L2CAP connection during netdev registration

bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a freed parent device.

Take a reference to the L2CAP connection while holding the channel lock. Retain it until register_netdev() has taken the parent device reference.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	65f53e9802dbfae0e5758a91793c3f5f8bece49b to before 390b5db3ff8745187f094c4e915663b7b1f98944Affected 65f53e9802dbfae0e5758a91793c3f5f8bece49b to before 46a88784c4c9b96954dd86f747ce93f65efa1302Affected 65f53e9802dbfae0e5758a91793c3f5f8bece49b to before 551ae773ec64045b4e72099132654887e0270bccAffected 65f53e9802dbfae0e5758a91793c3f5f8bece49b to before ae215c5b6422d8eda443b861b124bd1be6969c31Affected 65f53e9802dbfae0e5758a91793c3f5f8bece49b to before df22adc7eafc22e651561813c11dc51a796b12eeAffected 65f53e9802dbfae0e5758a91793c3f5f8bece49b to before a6b22dbd80926556290ad2243be25218d6956a19Affected 65f53e9802dbfae0e5758a91793c3f5f8bece49b to before 563a8573047182f550b1e1e030615755cd8c41daAffected 65f53e9802dbfae0e5758a91793c3f5f8bece49b to before bb067a99a0356196c0b89a95721985485ebce5a5Affected
LinuxLinux	3.13Affected before 3.13Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

65f53e9802dbfae0e5758a91793c3f5f8bece49b to before 390b5db3ff8745187f094c4e915663b7b1f98944Affected
65f53e9802dbfae0e5758a91793c3f5f8bece49b to before 46a88784c4c9b96954dd86f747ce93f65efa1302Affected
65f53e9802dbfae0e5758a91793c3f5f8bece49b to before 551ae773ec64045b4e72099132654887e0270bccAffected
65f53e9802dbfae0e5758a91793c3f5f8bece49b to before ae215c5b6422d8eda443b861b124bd1be6969c31Affected
65f53e9802dbfae0e5758a91793c3f5f8bece49b to before df22adc7eafc22e651561813c11dc51a796b12eeAffected
65f53e9802dbfae0e5758a91793c3f5f8bece49b to before a6b22dbd80926556290ad2243be25218d6956a19Affected
65f53e9802dbfae0e5758a91793c3f5f8bece49b to before 563a8573047182f550b1e1e030615755cd8c41daAffected
65f53e9802dbfae0e5758a91793c3f5f8bece49b to before bb067a99a0356196c0b89a95721985485ebce5a5Affected

LinuxLinux

3.13Affected
before 3.13Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.