Use-after-free in Linux kernel - CVE-2026-64434

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Bluetooth L2CAP channel timeout handler when processing an asynchronous channel timeout after the associated connection has been torn down. A local user can trigger a channel timeout race to cause a denial of service.

The issue arises because the timeout worker may access chan->conn after the underlying connection object has already been freed.

Affected software

How to mitigate CVE-2026-64434

External References

• https://git.kernel.org/stable/c/0b0e2bf39cf99e458d991b9df253727e036a7d7d
• https://git.kernel.org/stable/c/50c38d9f42a529691e4e67ea9cedf4f0bfc8d277
• https://git.kernel.org/stable/c/91047a4396a8b1857a6f712a90cf33ec0012b189
• https://git.kernel.org/stable/c/b66774b48dd98f07254951f74ea6f513efe7ff8b
• https://git.kernel.org/stable/c/d3b739db5dc6f688a60d56da872fabaf65246032

Related Security Bulletins

• Use-after-free in Linux kernel bluetooth
• Debian update for linux