CVE-2026-64406

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept_dequeue() bt_accept_get() takes a temporary reference before dropping the accept queue lock. bt_accept_dequeue() currently drops that reference before bt_accept_unlink(), leaving only the queue reference. bt_accept_unlink() drops the queue reference. The subsequent sock_hold() therefore accesses freed memory if it was the final reference, as observed by KASAN during listening L2CAP socket cleanup. Retain the temporary queue-walk reference through unlink and hand it to the caller on success. Drop it explicitly on the closed and not-yet-connected paths.

• linux linux kernel (>= 5.10.259 < 5.10.261) • linux linux kernel (>= 5.15.210 < 5.15.212) • linux linux kernel (>= 6.1.175 < 6.1.178) • linux linux kernel (>= 6.6.142 < 6.6.145) • linux linux kernel (>= 6.12.92 < 6.12.96) • linux linux kernel (>= 6.18.34 < 6.18.39) • linux linux kernel (>= 7.0.11 < 7.1) • linux linux kernel (>= 7.1.1 < 7.1.4) • linux linux kernel 7.1 • linux linux kernel 7.2