8

CVE-2026-64406

Bluetooth: fix UAF in bt_accept_dequeue()

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: fix UAF in bt_accept_dequeue()

bt_accept_get() takes a temporary reference before dropping the accept
queue lock. bt_accept_dequeue() currently drops that reference before
bt_accept_unlink(), leaving only the queue reference.

bt_accept_unlink() drops the queue reference. The subsequent
sock_hold() therefore accesses freed memory if it was the final
reference, as observed by KASAN during listening L2CAP socket cleanup.

Retain the temporary queue-walk reference through unlink and hand it to
the caller on success. Drop it explicitly on the closed and
not-yet-connected paths.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.10.259 < 5.10.261
Linux ≫ Linux Kernel Version >= 5.15.210 < 5.15.212
Linux ≫ Linux Kernel Version >= 6.1.175 < 6.1.178
Linux ≫ Linux Kernel Version >= 6.6.142 < 6.6.145
Linux ≫ Linux Kernel Version >= 6.12.92 < 6.12.96
Linux ≫ Linux Kernel Version >= 6.18.34 < 6.18.39
Linux ≫ Linux Kernel Version >= 7.0.11 < 7.1
Linux ≫ Linux Kernel Version >= 7.1.1 < 7.1.4
Linux ≫ Linux Kernel Version 7.1 Update -
Linux ≫ Linux Kernel Version 7.1 Update rc5
Linux ≫ Linux Kernel Version 7.1 Update rc6
Linux ≫ Linux Kernel Version 7.1 Update rc7
Linux ≫ Linux Kernel Version 7.2 Update rc1
Linux ≫ Linux Kernel Version 7.2 Update rc2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.196
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 8 2.1 5.9
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8d
Patch
https://git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547
Patch
https://git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0
Patch
https://git.kernel.org/stable/c/c66a95e60b65d876a927123b0ed36bd6177d9ca6
Patch
https://git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1db
Patch
https://git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614
Patch
https://git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049
Patch
https://git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9a
Patch