CVE-2026-74540Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp l2cap_le_connect_rsp() obtains a channel via __l2cap_get_chan_by_ident() but neither holds a reference nor uses l2cap_chan_hold_unless_zero() before locking and operating on it. A concurrent l2cap_chan_del() triggered by a remote disconnect can free the channel between the lookup and l2cap_chan_lock(), causing a use-after-free. The BR/EDR counterpart l2cap_connect_rsp() and the sibling handler l2cap_le_command_rej() already use l2cap_chan_hold_unless_zero() to safely hold a reference, but l2cap_le_connect_rsp() was left unprotected. Fix by adding l2cap_chan_hold_unless_zero() after the ident lookup and l2cap_chan_put() on the exit path, consistent with other L2CAP response handlers.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f1496dee9cbde2a62821f4441dadb0d3360f60c3 before 15d6c2367217a6a20b1abae9f38ded716bf620f1; from f1496dee9cbde2a62821f4441dadb0d3360f60c3 before 1818180fe12d6cec7a437bc59cde8efdf6b10250; from f1496dee9cbde2a62821f4441dadb0d3360f60c3 before 8325eafb38c3dee5af329266393763693d17381b; from f1496dee9cbde2a62821f4441dadb0d3360f60c3 before fd4c1e301bdec60a40728ea37de531cbccda501a; from f1496dee9cbde2a62821f4441dadb0d3360f60c3 before 522b730c62c53a1981604fd73524697fd347830d; from f1496dee9cbde2a62821f4441dadb0d3360f60c3 before 58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136; from f1496dee9cbde2a62821f4441dadb0d3360f60c3 before 09f447accc2570751e7d17f0dc0788b40d3edade; from f1496dee9cbde2a62821f4441dadb0d3360f60c3 before c4740e7f23ff9a8210198d8b4703259e21b9f69d | CNA record |
References
- https://git.kernel.org/stable/c/15d6c2367217a6a20b1abae9f38ded716bf620f1
- https://git.kernel.org/stable/c/1818180fe12d6cec7a437bc59cde8efdf6b10250
- https://git.kernel.org/stable/c/8325eafb38c3dee5af329266393763693d17381b
- https://git.kernel.org/stable/c/fd4c1e301bdec60a40728ea37de531cbccda501a
- https://git.kernel.org/stable/c/522b730c62c53a1981604fd73524697fd347830d
- https://git.kernel.org/stable/c/58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136
- https://git.kernel.org/stable/c/09f447accc2570751e7d17f0dc0788b40d3edade
- https://git.kernel.org/stable/c/c4740e7f23ff9a8210198d8b4703259e21b9f69d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.