In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix UAF in btacceptdequeue()
btacceptget() takes a temporary reference before dropping the accept queue lock. btacceptdequeue() currently drops that reference before btacceptunlink(), leaving only the queue reference.
btacceptunlink() drops the queue reference. The subsequent sock_hold() therefore accesses freed memory if it was the final reference, as observed by KASAN during listening L2CAP socket cleanup.
Retain the temporary queue-walk reference through unlink and hand it to the caller on success. Drop it explicitly on the closed and not-yet-connected paths.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64406.json"
}