Use-after-free in Linux kernel - CVE-2026-64557

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in l2cap_sock_new_connection_cb() in the Bluetooth L2CAP subsystem when handling a newly enqueued child socket reachable through the accept queue after the parent socket lock is released. A remote attacker can trigger a crafted Bluetooth L2CAP connection to execute arbitrary code.

The issue occurs because another task may accept and free the child socket before the callback dereferences it.

Affected software

How to mitigate CVE-2026-64557

External References

• https://git.kernel.org/stable/c/36da806f7fbaee56ad9e81859deec203f9728700
• https://git.kernel.org/stable/c/6fef032af0092ed5ccb767239a9ac1bc38c08a40
• https://git.kernel.org/stable/c/733e76e74e406c1d1ddc7369420dd8a47f48bb8a
• https://git.kernel.org/stable/c/84e718b6a814edc84159361f9f454a4e92ae91ae
• https://git.kernel.org/stable/c/8c37e4338c801ebb8cee52436c01c41e009f6e87
• https://git.kernel.org/stable/c/b39298044e5534612511a2ff5de03ba5f6e7a820

Related Security Bulletins

• Use-after-free in Linux kernel bluetooth
• Debian update for linux