AZL-93536
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-93536.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-93536
- Upstream
- Published
- 2026-07-25T10:17:24Z
- Modified
- 2026-08-28T17:47:48Z
- Summary
- CVE-2026-64406 affecting package kernel for versions less than 6.6.145.2-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix UAF in bt_accept_dequeue()
bt_accept_get() takes a temporary reference before dropping the accept queue lock. bt_accept_dequeue() currently drops that reference before bt_accept_unlink(), leaving only the queue reference.
bt_accept_unlink() drops the queue reference. The subsequent sock_hold() therefore accesses freed memory if it was the final reference, as observed by KASAN during listening L2CAP socket cleanup.
Retain the temporary queue-walk reference through unlink and hand it to the caller on success. Drop it explicitly on the closed and not-yet-connected paths.
- References