CVE-2026-74540

Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp

State: Published
Severity: 8.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp

l2cap_le_connect_rsp() obtains a channel via __l2cap_get_chan_by_ident() but neither holds a reference nor uses l2cap_chan_hold_unless_zero() before locking and operating on it. A concurrent l2cap_chan_del() triggered by a remote disconnect can free the channel between the lookup and l2cap_chan_lock(), causing a use-after-free.

The BR/EDR counterpart l2cap_connect_rsp() and the sibling handler l2cap_le_command_rej() already use l2cap_chan_hold_unless_zero() to safely hold a reference, but l2cap_le_connect_rsp() was left unprotected.

Fix by adding l2cap_chan_hold_unless_zero() after the ident lookup and l2cap_chan_put() on the exit path, consistent with other L2CAP response handlers.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f1496dee9cbde2a62821f4441dadb0d3360f60c3 to before 15d6c2367217a6a20b1abae9f38ded716bf620f1Affected f1496dee9cbde2a62821f4441dadb0d3360f60c3 to before 1818180fe12d6cec7a437bc59cde8efdf6b10250Affected f1496dee9cbde2a62821f4441dadb0d3360f60c3 to before 8325eafb38c3dee5af329266393763693d17381bAffected f1496dee9cbde2a62821f4441dadb0d3360f60c3 to before fd4c1e301bdec60a40728ea37de531cbccda501aAffected f1496dee9cbde2a62821f4441dadb0d3360f60c3 to before 522b730c62c53a1981604fd73524697fd347830dAffected f1496dee9cbde2a62821f4441dadb0d3360f60c3 to before 58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136Affected f1496dee9cbde2a62821f4441dadb0d3360f60c3 to before 09f447accc2570751e7d17f0dc0788b40d3edadeAffected f1496dee9cbde2a62821f4441dadb0d3360f60c3 to before c4740e7f23ff9a8210198d8b4703259e21b9f69dAffected
LinuxLinux	3.14Affected before 3.14Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.151 through 6.6.Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

f1496dee9cbde2a62821f4441dadb0d3360f60c3 to before 15d6c2367217a6a20b1abae9f38ded716bf620f1Affected
f1496dee9cbde2a62821f4441dadb0d3360f60c3 to before 1818180fe12d6cec7a437bc59cde8efdf6b10250Affected
f1496dee9cbde2a62821f4441dadb0d3360f60c3 to before 8325eafb38c3dee5af329266393763693d17381bAffected
f1496dee9cbde2a62821f4441dadb0d3360f60c3 to before fd4c1e301bdec60a40728ea37de531cbccda501aAffected
f1496dee9cbde2a62821f4441dadb0d3360f60c3 to before 522b730c62c53a1981604fd73524697fd347830dAffected
f1496dee9cbde2a62821f4441dadb0d3360f60c3 to before 58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136Affected
f1496dee9cbde2a62821f4441dadb0d3360f60c3 to before 09f447accc2570751e7d17f0dc0788b40d3edadeAffected
f1496dee9cbde2a62821f4441dadb0d3360f60c3 to before c4740e7f23ff9a8210198d8b4703259e21b9f69dAffected

LinuxLinux

3.14Affected
before 3.14Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.151 through 6.6.*Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.