CVE-2026-64408

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-64408
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64408.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-64408
Downstream
Published
2026-07-25T08:50:49.807Z
Modified
2026-07-28T04:02:47.861429993Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Bluetooth: bnep: pin L2CAP connection during netdev registration
Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bnep: pin L2CAP connection during netdev registration

bnepaddconnection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a freed parent device.

Take a reference to the L2CAP connection while holding the channel lock. Retain it until register_netdev() has taken the parent device reference.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64408.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
65f53e9802dbfae0e5758a91793c3f5f8bece49b
Fixed
390b5db3ff8745187f094c4e915663b7b1f98944
Fixed
46a88784c4c9b96954dd86f747ce93f65efa1302
Fixed
551ae773ec64045b4e72099132654887e0270bcc
Fixed
ae215c5b6422d8eda443b861b124bd1be6969c31
Fixed
df22adc7eafc22e651561813c11dc51a796b12ee
Fixed
a6b22dbd80926556290ad2243be25218d6956a19
Fixed
563a8573047182f550b1e1e030615755cd8c41da
Fixed
bb067a99a0356196c0b89a95721985485ebce5a5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64408.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.13.0
Fixed
5.10.261
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.212
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.178
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.145
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.96
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.39
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64408.json"