Use-after-free in Linux kernel - CVE-2026-64557

Vulnerability identifier: #VU140103

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-64557

CWE-ID: CWE-416

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in l2cap_sock_new_connection_cb() in the Bluetooth L2CAP subsystem when handling a newly enqueued child socket reachable through the accept queue after the parent socket lock is released. A remote attacker can trigger a crafted Bluetooth L2CAP connection to execute arbitrary code.

The issue occurs because another task may accept and free the child socket before the callback dereferences it.

Linux kernel
Debian Linux
openEuler
kernel
bpftool
bpftool-debuginfo
kernel-debuginfo
kernel-debugsource
kernel-devel
kernel-headers
kernel-source
kernel-tools
kernel-tools-debuginfo
kernel-tools-devel
perf
perf-debuginfo
python3-perf
python3-perf-debuginfo
linux (Debian package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel - update to 5.10.0-328.0.0.229
bpftool - update to 5.10.0-328.0.0.229
bpftool-debuginfo - update to 5.10.0-328.0.0.229
kernel-debuginfo - update to 5.10.0-328.0.0.229
kernel-debugsource - update to 5.10.0-328.0.0.229
kernel-devel - update to 5.10.0-328.0.0.229
kernel-headers - update to 5.10.0-328.0.0.229
kernel-source - update to 5.10.0-328.0.0.229
kernel-tools - update to 5.10.0-328.0.0.229
kernel-tools-debuginfo - update to 5.10.0-328.0.0.229
kernel-tools-devel - update to 5.10.0-328.0.0.229
perf - update to 5.10.0-328.0.0.229
perf-debuginfo - update to 5.10.0-328.0.0.229
python3-perf - update to 5.10.0-328.0.0.229
python3-perf-debuginfo - update to 5.10.0-328.0.0.229
linux (Debian package) - update to 6.12.100-1

• https://git.kernel.org/stable/c/36da806f7fbaee56ad9e81859deec203f9728700
• https://git.kernel.org/stable/c/6fef032af0092ed5ccb767239a9ac1bc38c08a40
• https://git.kernel.org/stable/c/733e76e74e406c1d1ddc7369420dd8a47f48bb8a
• https://git.kernel.org/stable/c/84e718b6a814edc84159361f9f454a4e92ae91ae
• https://git.kernel.org/stable/c/8c37e4338c801ebb8cee52436c01c41e009f6e87
• https://git.kernel.org/stable/c/b39298044e5534612511a2ff5de03ba5f6e7a820

• Use-after-free in Linux kernel bluetooth
• Debian update for linux
• openEuler 22.03 LTS SP4 update for kernel