CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1 - Configuration
Update/patch the Linux kernel Bluetooth L2CAP implementation so a new FLAG_DEL channel flag is introduced to indicate that the channel is being deleted, preventing the channel timeout path from using a freed l2cap_conn.
Linux kernel Bluetooth L2CAP FLAG_DEL channel flag = introduced to indicate channel deletion
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An attacker needs local access, low privileges, and high attack complexity. The issue involves an L2CAP channel timeout running asynchronously while its Bluetooth connection is being torn down.
What is the potential impact if the flaw is triggered?
The timeout worker can access a freed connection object and cause a use-after-free while attempting to lock the connection. The supplied severity vector indicates high confidentiality and availability impact, with no integrity impact.
How can I determine whether a system has encountered this problem?
Kernel diagnostics may report a KASAN slab-use-after-free involving l2cap_chan_timeout, mutex_lock, or conn->lock. The reported worker may appear as a kworker task executing the l2cap_chan_timeout workqueue handler.
Which software is identified as affected?
The provided data identifies the Linux kernel and Microsoft azl3 kernel 6.6.144.1-1. Consult the listed stable-kernel commits and Microsoft advisory for remediation details.