SB2026073034 - Use-after-free in Linux kernel bluetooth

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026073034

SB2026073034 - Use-after-free in Linux kernel bluetooth

Published: July 30, 2026

Security Bulletin ID SB2026073034
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Adjecent network
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use-after-free (CVE-ID: CVE-2026-64557)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in l2cap_sock_new_connection_cb() in the Bluetooth L2CAP subsystem when handling a newly enqueued child socket reachable through the accept queue after the parent socket lock is released. A remote attacker can trigger a crafted Bluetooth L2CAP connection to execute arbitrary code.

The issue occurs because another task may accept and free the child socket before the callback dereferences it.


Remediation

Install update from vendor's website.

References