CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: fix UAF in l2capleconnectrsp
l2capleconnectrsp() obtains a channel via l2capgetchanbyident() but neither holds a reference nor uses l2capchanholdunlesszero() before locking and operating on it. A concurrent l2capchandel() triggered by a remote disconnect can free the channel between the lookup and l2capchanlock(), causing a use-after-free.
The BR/EDR counterpart l2capconnectrsp() and the sibling handler l2caplecommandrej() already use l2capchanholdunlesszero() to safely hold a reference, but l2capleconnectrsp() was left unprotected.
Fix by adding l2capchanholdunlesszero() after the ident lookup and l2capchanput() on the exit path, consistent with other L2CAP response handlers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74540?
The severity level of CVE-2026-74540 is rated at 56.
How do I fix CVE-2026-74540?
To fix CVE-2026-74540, update your Linux kernel to the version that contains the patch addressing the use after free vulnerability.
What systems are affected by CVE-2026-74540?
CVE-2026-74540 affects versions of the Linux kernel that include the Bluetooth L2CAP component.
What is the impact of CVE-2026-74540?
The impact of CVE-2026-74540 can lead to potential denial of service or arbitrary code execution due to the use after free condition.
Who reported CVE-2026-74540?
CVE-2026-74540 was identified and reported by security researchers examining the Bluetooth subsystem in the Linux kernel.