CVE-2026-64406: Bluetooth: fix UAF in bt_accept_dequeue()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix UAF in btacceptdequeue()
btacceptget() takes a temporary reference before dropping the accept queue lock. btacceptdequeue() currently drops that reference before btacceptunlink(), leaving only the queue reference.
btacceptunlink() drops the queue reference. The subsequent sockhold() therefore accesses freed memory if it was the final reference, as observed by KASAN during listening L2CAP socket cleanup.
Retain the temporary queue-walk reference through unlink and hand it to the caller on success. Drop it explicitly on the closed and not-yet-connected paths.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64406?
The severity of CVE-2026-64406 is high with a CVSS score of 8.
How do I fix CVE-2026-64406?
To fix CVE-2026-64406, update your Linux kernel to the latest version that includes the patch addressing the use-after-free vulnerability.
What type of vulnerability is CVE-2026-64406?
CVE-2026-64406 is a use-after-free (UAF) vulnerability in the Bluetooth component of the Linux kernel.
What components are affected by CVE-2026-64406?
CVE-2026-64406 affects the Bluetooth subsystem in the Linux kernel.
When was CVE-2026-64406 published?
CVE-2026-64406 was published on July 25, 2026.