CVE-2026-64434
published 2026-07-25CVE-2026-64434: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2cap_chan_timeout() runs…
PriorityP346high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.26%
15.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
l2cap_chan_timeout() runs asynchronously and accesses chan->conn. If
the connection is torn down while the timer is running or pending,
chan->conn can be freed, leading to a use-after-free when the timer
worker attempts to lock conn->lock:
| BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
| BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]
| BUG: KASAN: slab-use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]
| BUG: KASAN: slab-use-after-free in mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318
| Write of size 8 at addr ffff8881298d9550 by task kworker/2:1/83
|
| CPU: 2 UID: 0 PID: 83 Comm: kworker/2:1 Not tainted 7.1.0-rc6-next-20260601-dirty #6 PREEMPT(full)
| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
| Workqueue: events l2cap_chan_timeout
| Call Trace:
|
| instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
| atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]
| __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]
| mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318
| l2cap_chan_timeout+0x5d/0x1b0 net/bluetooth/l2cap_core.c:422
| process_one_work kernel/workqueue.c:3326 [inline]
| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409
| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490
| kthread+0x346/0x430 kernel/kthread.c:436
| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158
| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
|
|
| Allocated by task 320:
| l2cap_conn_add+0xa7/0x820 net/bluetooth/l2cap_core.c:7075
| l2cap_connect_cfm+0xdb/0xd70 net/bluetooth/l2cap_core.c:7452
| hci_connect_cfm include/net/bluetooth/hci_core.h:2139 [inline]
| hci_remot
Affected
50 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 3634cbdc2eb414b69ffa752ddbe5e0458518e321 < 8f90405a4a6f1f1880dc07996b47bf57c712bd8a | 8f90405a4a6f1f1880dc07996b47bf57c712bd8a |
| linux | linux | >= 5.10.259 < 5.10.265 | 5.10.265 |
| linux | linux | >= 5.15.210 < 5.15.216 | 5.15.216 |
| linux | linux | >= 50dfec218808b148ab4247b1858031b7a32015c5 < 0b0e2bf39cf99e458d991b9df253727e036a7d7d | 0b0e2bf39cf99e458d991b9df253727e036a7d7d |
| linux | linux | >= 6.1.176 < 6.1.183 | 6.1.183 |
| linux | linux | >= 6.12.93 < 6.12.97 | 6.12.97 |
| linux | linux | >= 6.18.35 < 6.18.39 | 6.18.39 |
| linux | linux | >= 6.6.143 < 6.6.145 | 6.6.145 |
| linux | linux | >= 7.0.12 < 7.1 | 7.1 |
| linux | linux | >= 859d3ace791ed878ae9ba5522c7844d960da8f88 < d3b739db5dc6f688a60d56da872fabaf65246032 | d3b739db5dc6f688a60d56da872fabaf65246032 |
| linux | linux | >= 89dec92041717b027216e110599e4f6d6c921b79 < 91047a4396a8b1857a6f712a90cf33ec0012b189 | 91047a4396a8b1857a6f712a90cf33ec0012b189 |
| linux | linux | >= 8c8e620467a7b51562dbcefbd1f09f288d7d710d < 50c38d9f42a529691e4e67ea9cedf4f0bfc8d277 | 50c38d9f42a529691e4e67ea9cedf4f0bfc8d277 |
| linux | linux | >= 8c8e620467a7b51562dbcefbd1f09f288d7d710d < b66774b48dd98f07254951f74ea6f513efe7ff8b | b66774b48dd98f07254951f74ea6f513efe7ff8b |
| linux | linux | >= deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9 < 8922c7940bae9ce4b1736dddb6362370793835c2 | 8922c7940bae9ce4b1736dddb6362370793835c2 |
| linux | linux | >= e1c100e2d61bd8c718b7d91fe3e050780a9bf72d < 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b | 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.10.259 < 5.10.265 | 5.10.265 |
| linux | linux_kernel | >= 5.15.210 < 5.15.216 | 5.15.216 |
| linux | linux_kernel | >= 6.1.176 < 6.1.183 | 6.1.183 |
| linux | linux_kernel | >= 6.12.93 < 6.12.97 | 6.12.97 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_ubuntu9.1CRITICAL
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-10-13·CVSS 5.6
CVE-2026-72197 [MEDIUM] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly perform Reverse
Map Table (RMP) checks when the IOMMU accessed certain host buffers. A
local attacker with hypervisor access could possibly use this to trigger an
out-of-bounds condition and compromise the integrity of SEV-SNP guest
memory. (CVE-2023-20585)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- NVDIMM (Non-Volatile Memory Device) drivers;
- Handshake API;
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 archite
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-10-13·CVSS 5.6
CVE-2026-72213 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly perform Reverse
Map Table (RMP) checks when the IOMMU accessed certain host buffers. A
local attacker with hypervisor access could possibly use this to trigger an
out-of-bounds condition and compromise the integrity of SEV-SNP guest
memory. (CVE-2023-20585)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- NVDIMM (Non-Volatile Memory Device) drivers;
- Handshake API;
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
-
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-09-22·CVSS 9.1
CVE-2026-63869 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architecture;
Ubuntu
Linux kernel (NVIDIA BaseOS) vulnerabilities
vendor_ubuntu·2026-09-22
CVE-2026-64504 Linux kernel (NVIDIA BaseOS) vulnerabilities
Title: Linux kernel (NVIDIA BaseOS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- Intel NPU Driver;
- ACPI drivers;
- Android drivers;
- Drivers core;
- Compressed RAM block device driver;
- Bluetooth drivers;
- Character device driver;
- Hardware random number generator core;
- CPU frequency scaling framework;
- Hardware crypto device drivers
Ubuntu
Linux kernel (IBM) vulnerabilities
vendor_ubuntu·2026-09-21·CVSS 9.1
CVE-2026-63869 [CRITICAL] Linux kernel (IBM) vulnerabilities
Title: Linux kernel (IBM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architec
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-09-18·CVSS 9.1
CVE-2026-64504 [CRITICAL] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-09-15
CVE-2026-63869 Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- Intel NPU Driver;
- ACPI drivers;
- Android drivers;
- Drivers core;
- Compressed RAM block device driver;
- Bluetooth drivers;
- Character device driver;
- Hardware random number generator core;
- CPU frequency scaling framework;
- Hardware crypto device drivers;
- Buf
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-09-07·CVSS 9.1
CVE-2026-64504 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architecture;
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-09-07·CVSS 9.1
CVE-2026-63869 [CRITICAL] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architec
Red Hat
kernel: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
vendor_redhat·2026-07-25·CVSS 8.8
CVE-2026-64434 [HIGH] CWE-364 kernel: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
kernel: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) component. An asynchronous operation in the l2cap_chan_timeout() function can attempt to access a connection that has already been deallocated. This use-after-free vulnerability could allow a local attacker to cause a denial of service or potentially execute arbitrary code.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise
GHSA
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2cap_chan_timeout() runs asynchronously and accesses chan->conn.
ghsa_unreviewed·2026-07-25
CVE-2026-64434 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2cap_chan_timeout() runs asynchronously and accesses chan->conn.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
l2cap_chan_timeout() runs asynchronously and accesses chan->conn. If
the connection is torn down while the timer is running or pending,
chan->conn can be freed, leading to a use-after-free when the timer
worker attempts to lock conn->lock:
| BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
| BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]
| BUG: KASAN: slab-use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]
| BUG: KASAN: slab-use-after-free in mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318
| Write of
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0b0e2bf39cf99e458d991b9df253727e036a7d7dhttps://git.kernel.org/stable/c/32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26bhttps://git.kernel.org/stable/c/50c38d9f42a529691e4e67ea9cedf4f0bfc8d277https://git.kernel.org/stable/c/8922c7940bae9ce4b1736dddb6362370793835c2https://git.kernel.org/stable/c/8f90405a4a6f1f1880dc07996b47bf57c712bd8ahttps://git.kernel.org/stable/c/91047a4396a8b1857a6f712a90cf33ec0012b189https://git.kernel.org/stable/c/b66774b48dd98f07254951f74ea6f513efe7ff8bhttps://git.kernel.org/stable/c/d3b739db5dc6f688a60d56da872fabaf65246032
2026-07-25
Published