{"id":"CVE-2026-64557","state":"PUBLISHED","title":"Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n\nl2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after\nrelease_sock(parent). Once the parent lock is dropped the newly\nenqueued child socket sk is reachable via the accept queue, so another\ntask can accept and free it before the callback dereferences sk,\nresulting in a use-after-free.\n\nRework the ->new_connection() op so the core, rather than the callback,\nowns the child channel's lifetime. The op now receives a pre-allocated\nnew_chan and returns an errno instead of allocating and returning a\nchannel. l2cap_new_connection() allocates the child channel and links\nit into the conn list via __l2cap_chan_add() before invoking the\ncallback, so the conn-list reference keeps the channel alive once\nrelease_sock(parent) exposes the socket to other tasks.\n\nChannel configuration that was duplicated in l2cap_sock_init() and the\nvarious new_connection callbacks is consolidated into\nl2cap_chan_set_defaults(), which now inherits from the parent channel\nwhen one is supplied.","publishedAt":"2026-07-29T08:01:47.462Z","updatedAt":"2026-10-19T20:48:41.023Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"8ffb929098a56939ac71509302eeab5b207bf262","status":"affected","lessThan":"b39298044e5534612511a2ff5de03ba5f6e7a820","versionType":"git"},{"version":"8ffb929098a56939ac71509302eeab5b207bf262","status":"affected","lessThan":"8c37e4338c801ebb8cee52436c01c41e009f6e87","versionType":"git"},{"version":"8ffb929098a56939ac71509302eeab5b207bf262","status":"affected","lessThan":"84e718b6a814edc84159361f9f454a4e92ae91ae","versionType":"git"},{"version":"8ffb929098a56939ac71509302eeab5b207bf262","status":"affected","lessThan":"36da806f7fbaee56ad9e81859deec203f9728700","versionType":"git"},{"version":"8ffb929098a56939ac71509302eeab5b207bf262","status":"affected","lessThan":"733e76e74e406c1d1ddc7369420dd8a47f48bb8a","versionType":"git"},{"version":"8ffb929098a56939ac71509302eeab5b207bf262","status":"affected","lessThan":"6fef032af0092ed5ccb767239a9ac1bc38c08a40","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/net/bluetooth/l2cap.h","net/bluetooth/6lowpan.c","net/bluetooth/l2cap_core.c","net/bluetooth/l2cap_sock.c","net/bluetooth/smp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.13","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/net/bluetooth/l2cap.h","net/bluetooth/6lowpan.c","net/bluetooth/l2cap_core.c","net/bluetooth/l2cap_sock.c","net/bluetooth/smp.c"]}],"references":["https://git.kernel.org/stable/c/b39298044e5534612511a2ff5de03ba5f6e7a820","https://git.kernel.org/stable/c/8c37e4338c801ebb8cee52436c01c41e009f6e87","https://git.kernel.org/stable/c/84e718b6a814edc84159361f9f454a4e92ae91ae","https://git.kernel.org/stable/c/36da806f7fbaee56ad9e81859deec203f9728700","https://git.kernel.org/stable/c/733e76e74e406c1d1ddc7369420dd8a47f48bb8a","https://git.kernel.org/stable/c/6fef032af0092ed5ccb767239a9ac1bc38c08a40"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64557.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64557","state":"PUBLISHED","datePublished":"2026-07-29T08:01:47.462Z","dateUpdated":"2026-10-19T20:48:41.023Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T15:36:31.796Z"},"containers":{"cna":{"title":"Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n\nl2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after\nrelease_sock(parent). Once the parent lock is dropped the newly\nenqueued child socket sk is reachable via the accept queue, so another\ntask can accept and free it before the callback dereferences sk,\nresulting in a use-after-free.\n\nRework the ->new_connection() op so the core, rather than the callback,\nowns the child channel's lifetime. The op now receives a pre-allocated\nnew_chan and returns an errno instead of allocating and returning a\nchannel. l2cap_new_connection() allocates the child channel and links\nit into the conn list via __l2cap_chan_add() before invoking the\ncallback, so the conn-list reference keeps the channel alive once\nrelease_sock(parent) exposes the socket to other tasks.\n\nChannel configuration that was duplicated in l2cap_sock_init() and the\nvarious new_connection callbacks is consolidated into\nl2cap_chan_set_defaults(), which now inherits from the parent channel\nwhen one is supplied."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"8ffb929098a56939ac71509302eeab5b207bf262","status":"affected","lessThan":"b39298044e5534612511a2ff5de03ba5f6e7a820","versionType":"git"},{"version":"8ffb929098a56939ac71509302eeab5b207bf262","status":"affected","lessThan":"8c37e4338c801ebb8cee52436c01c41e009f6e87","versionType":"git"},{"version":"8ffb929098a56939ac71509302eeab5b207bf262","status":"affected","lessThan":"84e718b6a814edc84159361f9f454a4e92ae91ae","versionType":"git"},{"version":"8ffb929098a56939ac71509302eeab5b207bf262","status":"affected","lessThan":"36da806f7fbaee56ad9e81859deec203f9728700","versionType":"git"},{"version":"8ffb929098a56939ac71509302eeab5b207bf262","status":"affected","lessThan":"733e76e74e406c1d1ddc7369420dd8a47f48bb8a","versionType":"git"},{"version":"8ffb929098a56939ac71509302eeab5b207bf262","status":"affected","lessThan":"6fef032af0092ed5ccb767239a9ac1bc38c08a40","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/net/bluetooth/l2cap.h","net/bluetooth/6lowpan.c","net/bluetooth/l2cap_core.c","net/bluetooth/l2cap_sock.c","net/bluetooth/smp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.13","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/net/bluetooth/l2cap.h","net/bluetooth/6lowpan.c","net/bluetooth/l2cap_core.c","net/bluetooth/l2cap_sock.c","net/bluetooth/smp.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/b39298044e5534612511a2ff5de03ba5f6e7a820"},{"url":"https://git.kernel.org/stable/c/8c37e4338c801ebb8cee52436c01c41e009f6e87"},{"url":"https://git.kernel.org/stable/c/84e718b6a814edc84159361f9f454a4e92ae91ae"},{"url":"https://git.kernel.org/stable/c/36da806f7fbaee56ad9e81859deec203f9728700"},{"url":"https://git.kernel.org/stable/c/733e76e74e406c1d1ddc7369420dd8a47f48bb8a"},{"url":"https://git.kernel.org/stable/c/6fef032af0092ed5ccb767239a9ac1bc38c08a40"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable callback is reached only from L2CAP signalling handlers (`l2cap_connect`, `l2cap_le_connect_req`, `l2cap_ecred_conn_req`, `l2cap_connect_cfm`) processing connection requests received from a remote Bluetooth peer. Bluetooth radio range constitutes an adjacent network.\nAC:L - The attacker drives one side of the race by sending unlimited L2CAP connect requests and can induce the other side, since the local daemon accepts (immediately, for DEFER_SETUP listeners) and closes rejected/unauthorized children; on SMP the accepting task runs truly concurrently while the callback is still inside `release_sock()`, so the window is hit reliably with repeated attempts.\nPR:N - `l2cap_connect()` bypasses the link-mode and encryption-key-size checks entirely for PSM 0x0001 (SDP), where bluetoothd holds a listening L2CAP socket, so an unpaired and unauthenticated remote device can reach `l2cap_sock_new_connection_cb()`; LE CoC and low-security BR/EDR listeners are likewise reachable without credentials.\nUI:N - Incoming L2CAP connection requests are processed automatically by the kernel and accepted by the always-running Bluetooth daemon with no victim action, no pairing prompt, and no user confirmation.\nS:U - The corrupted `l2cap_chan`/`sock` objects and the resulting memory corruption are confined to the kernel's own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free: the freed `l2cap_chan` slab object can be reallocated with attacker-groomed data and its fields are subsequently read back and transmitted to the attacker via the connect response and `l2cap_build_conf_req()`, and `__l2cap_chan_add()` deposits kernel list pointers into the reallocated object, giving a kernel-memory disclosure primitive.\nI:H - After the free, `l2cap_connect()`/`l2cap_le_connect_req()` write attacker-supplied PSM, SCID, MTU/MPS and BD_ADDR values plus list pointers into the freed object, and `__set_chan_timer()` arms delayed work whose function pointers live in that freed memory — a controlled write primitive suitable for heap spraying and control-flow hijack.\nA:H - Even without successful exploitation, the use-after-free reads and writes into freed slab memory and links a dead object into the conn list, reliably producing kernel oops/panic and corrupted list traversal on subsequent L2CAP operations."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T04:57:35.594Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-64557","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:42:36.931417Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T20:48:41.023Z"}}]}}}