CVE-2026-64557 (GCVE-0-2026-64557)

Vulnerability from cvelistv5 – Published: 2026-07-29 08:01 – Updated: 2026-08-05 12:43
VLAI
Title
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after release_sock(parent). Once the parent lock is dropped the newly enqueued child socket sk is reachable via the accept queue, so another task can accept and free it before the callback dereferences sk, resulting in a use-after-free. Rework the ->new_connection() op so the core, rather than the callback, owns the child channel's lifetime. The op now receives a pre-allocated new_chan and returns an errno instead of allocating and returning a channel. l2cap_new_connection() allocates the child channel and links it into the conn list via __l2cap_chan_add() before invoking the callback, so the conn-list reference keeps the channel alive once release_sock(parent) exposes the socket to other tasks. Channel configuration that was duplicated in l2cap_sock_init() and the various new_connection callbacks is consolidated into l2cap_chan_set_defaults(), which now inherits from the parent channel when one is supplied.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8ffb929098a56939ac71509302eeab5b207bf262 , < b39298044e5534612511a2ff5de03ba5f6e7a820 (git)
Affected: 8ffb929098a56939ac71509302eeab5b207bf262 , < 8c37e4338c801ebb8cee52436c01c41e009f6e87 (git)
Affected: 8ffb929098a56939ac71509302eeab5b207bf262 , < 84e718b6a814edc84159361f9f454a4e92ae91ae (git)
Affected: 8ffb929098a56939ac71509302eeab5b207bf262 , < 36da806f7fbaee56ad9e81859deec203f9728700 (git)
Affected: 8ffb929098a56939ac71509302eeab5b207bf262 , < 733e76e74e406c1d1ddc7369420dd8a47f48bb8a (git)
Affected: 8ffb929098a56939ac71509302eeab5b207bf262 , < 6fef032af0092ed5ccb767239a9ac1bc38c08a40 (git)
Create a notification for this product.
Linux Linux Affected: 3.13
Unaffected: 0 , < 3.13 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/bluetooth/l2cap.h",
            "net/bluetooth/6lowpan.c",
            "net/bluetooth/l2cap_core.c",
            "net/bluetooth/l2cap_sock.c",
            "net/bluetooth/smp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b39298044e5534612511a2ff5de03ba5f6e7a820",
              "status": "affected",
              "version": "8ffb929098a56939ac71509302eeab5b207bf262",
              "versionType": "git"
            },
            {
              "lessThan": "8c37e4338c801ebb8cee52436c01c41e009f6e87",
              "status": "affected",
              "version": "8ffb929098a56939ac71509302eeab5b207bf262",
              "versionType": "git"
            },
            {
              "lessThan": "84e718b6a814edc84159361f9f454a4e92ae91ae",
              "status": "affected",
              "version": "8ffb929098a56939ac71509302eeab5b207bf262",
              "versionType": "git"
            },
            {
              "lessThan": "36da806f7fbaee56ad9e81859deec203f9728700",
              "status": "affected",
              "version": "8ffb929098a56939ac71509302eeab5b207bf262",
              "versionType": "git"
            },
            {
              "lessThan": "733e76e74e406c1d1ddc7369420dd8a47f48bb8a",
              "status": "affected",
              "version": "8ffb929098a56939ac71509302eeab5b207bf262",
              "versionType": "git"
            },
            {
              "lessThan": "6fef032af0092ed5ccb767239a9ac1bc38c08a40",
              "status": "affected",
              "version": "8ffb929098a56939ac71509302eeab5b207bf262",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/bluetooth/l2cap.h",
            "net/bluetooth/6lowpan.c",
            "net/bluetooth/l2cap_core.c",
            "net/bluetooth/l2cap_sock.c",
            "net/bluetooth/smp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc3",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n\nl2cap_sock_new_connection_cb() returned l2cap_pi(sk)-\u003echan after\nrelease_sock(parent). Once the parent lock is dropped the newly\nenqueued child socket sk is reachable via the accept queue, so another\ntask can accept and free it before the callback dereferences sk,\nresulting in a use-after-free.\n\nRework the -\u003enew_connection() op so the core, rather than the callback,\nowns the child channel\u0027s lifetime. The op now receives a pre-allocated\nnew_chan and returns an errno instead of allocating and returning a\nchannel. l2cap_new_connection() allocates the child channel and links\nit into the conn list via __l2cap_chan_add() before invoking the\ncallback, so the conn-list reference keeps the channel alive once\nrelease_sock(parent) exposes the socket to other tasks.\n\nChannel configuration that was duplicated in l2cap_sock_init() and the\nvarious new_connection callbacks is consolidated into\nl2cap_chan_set_defaults(), which now inherits from the parent channel\nwhen one is supplied."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable callback is reached only from L2CAP signalling handlers (`l2cap_connect`, `l2cap_le_connect_req`, `l2cap_ecred_conn_req`, `l2cap_connect_cfm`) processing connection requests received from a remote Bluetooth peer. Bluetooth radio range constitutes an adjacent network.\nAC:L - The attacker drives one side of the race by sending unlimited L2CAP connect requests and can induce the other side, since the local daemon accepts (immediately, for DEFER_SETUP listeners) and closes rejected/unauthorized children; on SMP the accepting task runs truly concurrently while the callback is still inside `release_sock()`, so the window is hit reliably with repeated attempts.\nPR:N - `l2cap_connect()` bypasses the link-mode and encryption-key-size checks entirely for PSM 0x0001 (SDP), where bluetoothd holds a listening L2CAP socket, so an unpaired and unauthenticated remote device can reach `l2cap_sock_new_connection_cb()`; LE CoC and low-security BR/EDR listeners are likewise reachable without credentials.\nUI:N - Incoming L2CAP connection requests are processed automatically by the kernel and accepted by the always-running Bluetooth daemon with no victim action, no pairing prompt, and no user confirmation.\nS:U - The corrupted `l2cap_chan`/`sock` objects and the resulting memory corruption are confined to the kernel\u0027s own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free: the freed `l2cap_chan` slab object can be reallocated with attacker-groomed data and its fields are subsequently read back and transmitted to the attacker via the connect response and `l2cap_build_conf_req()`, and `__l2cap_chan_add()` deposits kernel list pointers into the reallocated object, giving a kernel-memory disclosure primitive.\nI:H - After the free, `l2cap_connect()`/`l2cap_le_connect_req()` write attacker-supplied PSM, SCID, MTU/MPS and BD_ADDR values plus list pointers into the freed object, and `__set_chan_timer()` arms delayed work whose function pointers live in that freed memory \u2014 a controlled write primitive suitable for heap spraying and control-flow hijack.\nA:H - Even without successful exploitation, the use-after-free reads and writes into freed slab memory and links a dead object into the conn list, reliably producing kernel oops/panic and corrupted list traversal on subsequent L2CAP operations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:43:02.841Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b39298044e5534612511a2ff5de03ba5f6e7a820"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c37e4338c801ebb8cee52436c01c41e009f6e87"
        },
        {
          "url": "https://git.kernel.org/stable/c/84e718b6a814edc84159361f9f454a4e92ae91ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/36da806f7fbaee56ad9e81859deec203f9728700"
        },
        {
          "url": "https://git.kernel.org/stable/c/733e76e74e406c1d1ddc7369420dd8a47f48bb8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fef032af0092ed5ccb767239a9ac1bc38c08a40"
        }
      ],
      "title": "Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64557",
    "datePublished": "2026-07-29T08:01:47.462Z",
    "dateReserved": "2026-07-19T15:36:31.796Z",
    "dateUpdated": "2026-08-05T12:43:02.841Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64557",
      "date": "2026-08-09",
      "epss": "0.00236",
      "percentile": "0.1457"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64557\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-29T09:16:30.280\",\"lastModified\":\"2026-07-30T06:25:59.477\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\\n\\nl2cap_sock_new_connection_cb() returned l2cap_pi(sk)-\u003echan after\\nrelease_sock(parent). Once the parent lock is dropped the newly\\nenqueued child socket sk is reachable via the accept queue, so another\\ntask can accept and free it before the callback dereferences sk,\\nresulting in a use-after-free.\\n\\nRework the -\u003enew_connection() op so the core, rather than the callback,\\nowns the child channel\u0027s lifetime. The op now receives a pre-allocated\\nnew_chan and returns an errno instead of allocating and returning a\\nchannel. l2cap_new_connection() allocates the child channel and links\\nit into the conn list via __l2cap_chan_add() before invoking the\\ncallback, so the conn-list reference keeps the channel alive once\\nrelease_sock(parent) exposes the socket to other tasks.\\n\\nChannel configuration that was duplicated in l2cap_sock_init() and the\\nvarious new_connection callbacks is consolidated into\\nl2cap_chan_set_defaults(), which now inherits from the parent channel\\nwhen one is supplied.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/bluetooth/l2cap.h\",\"net/bluetooth/6lowpan.c\",\"net/bluetooth/l2cap_core.c\",\"net/bluetooth/l2cap_sock.c\",\"net/bluetooth/smp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8ffb929098a56939ac71509302eeab5b207bf262\",\"lessThan\":\"b39298044e5534612511a2ff5de03ba5f6e7a820\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8ffb929098a56939ac71509302eeab5b207bf262\",\"lessThan\":\"8c37e4338c801ebb8cee52436c01c41e009f6e87\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8ffb929098a56939ac71509302eeab5b207bf262\",\"lessThan\":\"84e718b6a814edc84159361f9f454a4e92ae91ae\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8ffb929098a56939ac71509302eeab5b207bf262\",\"lessThan\":\"36da806f7fbaee56ad9e81859deec203f9728700\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8ffb929098a56939ac71509302eeab5b207bf262\",\"lessThan\":\"733e76e74e406c1d1ddc7369420dd8a47f48bb8a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8ffb929098a56939ac71509302eeab5b207bf262\",\"lessThan\":\"6fef032af0092ed5ccb767239a9ac1bc38c08a40\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/bluetooth/l2cap.h\",\"net/bluetooth/6lowpan.c\",\"net/bluetooth/l2cap_core.c\",\"net/bluetooth/l2cap_sock.c\",\"net/bluetooth/smp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/36da806f7fbaee56ad9e81859deec203f9728700\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6fef032af0092ed5ccb767239a9ac1bc38c08a40\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/733e76e74e406c1d1ddc7369420dd8a47f48bb8a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/84e718b6a814edc84159361f9f454a4e92ae91ae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8c37e4338c801ebb8cee52436c01c41e009f6e87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b39298044e5534612511a2ff5de03ba5f6e7a820\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:28:22+00:00",
      "cve": "CVE-2026-64557",
      "id": "CVE-2026-64557",
      "initial_release_date": "2026-07-29T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64557.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.