High · published September 18, 2025
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix user-after-free
This uses l2cap_chan_hold_unless_zero() after calling
__l2cap_get_chan_blah() to prevent the following trace:
Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref
*kref)
Bluetooth: chan 0000000023c4974d
Bluetooth: parent 00000000ae861c08
==================================================================
BUG: KASAN: use-after-free in __mutex_waiter_is_first
kernel/locking/mutex.c:191 [inline]
BUG: KASAN: use-after-free in __mutex_lock_common
kernel/locking/mutex.c:671 [inline]
BUG: KASAN: use-after-free in __mutex_lock+0x278/0x400
kernel/locking/mutex.c:729
Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | < 4.9.331 | 4.9.331 |
| linux/linux_kernel | ≥ 4.10, < 4.14.296 | 4.14.296 |
| linux/linux_kernel | ≥ 4.15, < 4.19.262 | 4.19.262 |
| linux/linux_kernel | ≥ 4.20, < 5.4.220 | 5.4.220 |
| linux/linux_kernel | ≥ 5.5, < 5.10.150 | 5.10.150 |
| linux/linux_kernel | ≥ 5.11, < 5.15.75 | 5.15.75 |
| linux/linux_kernel | ≥ 5.16, < 5.19.17 | 5.19.17 |
| linux/linux_kernel | ≥ 6.0, < 6.0.3 | 6.0.3 |