AZL-93788
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-93788.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-93788
- Upstream
- Published
- 2026-07-25T10:17:24Z
- Modified
- 2026-08-28T17:48:13.117169233Z
- Summary
- CVE-2026-64408 affecting package kernel for versions less than 6.6.145.2-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: bnep: pin L2CAP connection during netdev registration
bnepaddconnection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a freed parent device.
Take a reference to the L2CAP connection while holding the channel lock. Retain it until register_netdev() has taken the parent device reference.
- References