{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-64434", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.787Z", "datePublished": "2026-07-25T08:51:09.066Z", "dateUpdated": "2026-10-19T20:38:28.580Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:28:16.061Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\n\nl2cap_chan_timeout() runs asynchronously and accesses chan->conn. If\nthe connection is torn down while the timer is running or pending,\nchan->conn can be freed, leading to a use-after-free when the timer\nworker attempts to lock conn->lock:\n\n| BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]\n| BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]\n| BUG: KASAN: slab-use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]\n| BUG: KASAN: slab-use-after-free in mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318\n| Write of size 8 at addr ffff8881298d9550 by task kworker/2:1/83\n|\n| CPU: 2 UID: 0 PID: 83 Comm: kworker/2:1 Not tainted 7.1.0-rc6-next-20260601-dirty #6 PREEMPT(full)\n| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\n| Workqueue: events l2cap_chan_timeout\n| Call Trace:\n| \n| instrument_atomic_read_write include/linux/instrumented.h:112 [inline]\n| atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]\n| __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]\n| mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318\n| l2cap_chan_timeout+0x5d/0x1b0 net/bluetooth/l2cap_core.c:422\n| process_one_work kernel/workqueue.c:3326 [inline]\n| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409\n| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490\n| kthread+0x346/0x430 kernel/kthread.c:436\n| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158\n| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n| \n|\n| Allocated by task 320:\n| l2cap_conn_add+0xa7/0x820 net/bluetooth/l2cap_core.c:7075\n| l2cap_connect_cfm+0xdb/0xd70 net/bluetooth/l2cap_core.c:7452\n| hci_connect_cfm include/net/bluetooth/hci_core.h:2139 [inline]\n| hci_remote_features_evt+0x52f/0x9f0 net/bluetooth/hci_event.c:3760\n| hci_event_func net/bluetooth/hci_event.c:7796 [inline]\n| hci_event_packet+0x561/0xa70 net/bluetooth/hci_event.c:7847\n| hci_rx_work+0x370/0x890 net/bluetooth/hci_core.c:4040\n| process_one_work kernel/workqueue.c:3326 [inline]\n| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409\n| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490\n| kthread+0x346/0x430 kernel/kthread.c:436\n| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158\n| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n|\n| Freed by task 322:\n| hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline]\n| hci_conn_hash_flush+0x101/0x1f0 net/bluetooth/hci_conn.c:2736\n| hci_dev_close_sync+0x889/0xde0 net/bluetooth/hci_sync.c:5405\n| hci_dev_do_close net/bluetooth/hci_core.c:502 [inline]\n| hci_unregister_dev+0x1f7/0x370 net/bluetooth/hci_core.c:2679\n| vhci_release+0x12a/0x180 drivers/bluetooth/hci_vhci.c:690\n| __fput+0x369/0x890 fs/file_table.c:510\n| task_work_run+0x160/0x1d0 kernel/task_work.c:233\n| get_signal+0xf5b/0x1120 kernel/signal.c:2810\n| arch_do_signal_or_restart+0x4d/0x600 arch/x86/kernel/signal.c:337\n| __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]\n| exit_to_user_mode_loop+0x85/0x510 kernel/entry/common.c:98\n| do_syscall_64+0x263/0x3d0 arch/x86/entry/syscall_64.c:100\n| entry_SYSCALL_64_after_hwframe+0x77/0x7f\n|\n| The buggy address belongs to the object at ffff8881298d9400\n| which belongs to the cache kmalloc-512 of size 512\n| The buggy address is located 336 bytes inside of\n| freed 512-byte region [ffff8881298d9400, ffff8881298d9600)\n\nFix it by having chan->conn hold a reference to l2cap_conn (via\nl2cap_conn_get) when the channel is added to the connection, and\nreleasing it in the channel destructor. This ensures the l2cap_conn\nremains alive as long as the channel exists.\n\nA new FLAG_DEL channel flag is introduced to indicate that the ch\n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - An unauthenticated Bluetooth peer within radio range can reach the vulnerable worker by creating a half-configured L2CAP channel and subsequently terminating the ACL connection.\nAC:L - The attacker controls both channel creation and connection teardown, can leave the 40-second channel timer armed, and can repeat or parallelize attempts to win the race.\nPR:N - The BR/EDR signaling path processes incoming L2CAP requests before application acceptance, and an SDP listener permits this path without pairing or authentication.\nUI:N - Exploitation requires no victim action because an already-running Bluetooth service and the kernel independently process the connection, timer, and disconnection.\nS:U - The UAF compromises the host kernel within the same security authority and does not inherently cross a VM, IOMMU, or comparable boundary.\nC:H - The freed kmalloc object can be reclaimed with attacker-influenced contents, allowing the UAF to support kernel-memory disclosure primitives.\nI:H - The worker performs mutex writes into the freed allocation, enabling heap corruption and potentially arbitrary write or kernel control-flow hijacking after heap grooming.\nA:H - The stale mutex access can corrupt memory, trigger an oops or panic, and can be retriggered by a nearby Bluetooth peer." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/net/bluetooth/l2cap.h", "net/bluetooth/l2cap_core.c" ], "versions": [ { "version": "3634cbdc2eb414b69ffa752ddbe5e0458518e321", "lessThan": "8f90405a4a6f1f1880dc07996b47bf57c712bd8a", "status": "affected", "versionType": "git" }, { "version": "e1c100e2d61bd8c718b7d91fe3e050780a9bf72d", "lessThan": "32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b", "status": "affected", "versionType": "git" }, { "version": "deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9", "lessThan": "8922c7940bae9ce4b1736dddb6362370793835c2", "status": "affected", "versionType": "git" }, { "version": "89dec92041717b027216e110599e4f6d6c921b79", "lessThan": "91047a4396a8b1857a6f712a90cf33ec0012b189", "status": "affected", "versionType": "git" }, { "version": "50dfec218808b148ab4247b1858031b7a32015c5", "lessThan": "0b0e2bf39cf99e458d991b9df253727e036a7d7d", "status": "affected", "versionType": "git" }, { "version": "859d3ace791ed878ae9ba5522c7844d960da8f88", "lessThan": "d3b739db5dc6f688a60d56da872fabaf65246032", "status": "affected", "versionType": "git" }, { "version": "8c8e620467a7b51562dbcefbd1f09f288d7d710d", "lessThan": "50c38d9f42a529691e4e67ea9cedf4f0bfc8d277", "status": "affected", "versionType": "git" }, { "version": "8c8e620467a7b51562dbcefbd1f09f288d7d710d", "lessThan": "b66774b48dd98f07254951f74ea6f513efe7ff8b", "status": "affected", "versionType": "git" }, { "version": "7555fd885a0603f50e49a655850a1f2bd8a25398", "status": "affected", "versionType": "git" }, { "version": "5.10.259", "lessThan": "5.10.265", "status": "affected", "versionType": "semver" }, { "version": "5.15.210", "lessThan": "5.15.216", "status": "affected", "versionType": "semver" }, { "version": "6.1.176", "lessThan": "6.1.183", "status": "affected", "versionType": "semver" }, { "version": "6.6.143", "lessThan": "6.6.145", "status": "affected", "versionType": "semver" }, { "version": "6.12.93", "lessThan": "6.12.97", "status": "affected", "versionType": "semver" }, { "version": "6.18.35", "lessThan": "6.18.39", "status": "affected", "versionType": "semver" }, { "version": "7.0.12", "lessThan": "7.1", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/net/bluetooth/l2cap.h", "net/bluetooth/l2cap_core.c" ], "versions": [ { "version": "7.1", "status": "affected" }, { "version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.259", "versionEndExcluding": "5.10.265" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.210", "versionEndExcluding": "5.15.216" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.176", "versionEndExcluding": "6.1.183" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.143", "versionEndExcluding": "6.6.145" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.93", "versionEndExcluding": "6.12.97" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.35", "versionEndExcluding": "6.18.39" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.1.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/8f90405a4a6f1f1880dc07996b47bf57c712bd8a" }, { "url": "https://git.kernel.org/stable/c/32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b" }, { "url": "https://git.kernel.org/stable/c/8922c7940bae9ce4b1736dddb6362370793835c2" }, { "url": "https://git.kernel.org/stable/c/91047a4396a8b1857a6f712a90cf33ec0012b189" }, { "url": "https://git.kernel.org/stable/c/0b0e2bf39cf99e458d991b9df253727e036a7d7d" }, { "url": "https://git.kernel.org/stable/c/d3b739db5dc6f688a60d56da872fabaf65246032" }, { "url": "https://git.kernel.org/stable/c/50c38d9f42a529691e4e67ea9cedf4f0bfc8d277" }, { "url": "https://git.kernel.org/stable/c/b66774b48dd98f07254951f74ea6f513efe7ff8b" } ], "title": "Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2026-64434", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2026-10-16T15:40:36.220743Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:38:28.580Z" } } ] } }