High · published July 25, 2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix UAF in bt_accept_dequeue()
bt_accept_get() takes a temporary reference before dropping the accept
queue lock. bt_accept_dequeue() currently drops that reference before
bt_accept_unlink(), leaving only the queue reference.
bt_accept_unlink() drops the queue reference. The subsequent
sock_hold() therefore accesses freed memory if it was the final
reference, as observed by KASAN during listening L2CAP socket cleanup.
Retain the temporary queue-walk reference through unlink and hand it to
the caller on success. Drop it explicitly on the closed and
not-yet-connected paths.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 5.10.259, < 5.10.261 | 5.10.261 |
| linux/linux_kernel | ≥ 5.15.210, < 5.15.212 | 5.15.212 |
| linux/linux_kernel | ≥ 6.1.175, < 6.1.178 | 6.1.178 |
| linux/linux_kernel | ≥ 6.6.142, < 6.6.145 | 6.6.145 |
| linux/linux_kernel | ≥ 6.12.92, < 6.12.96 | 6.12.96 |
| linux/linux_kernel | ≥ 6.18.34, < 6.18.39 | 6.18.39 |
| linux/linux_kernel | ≥ 7.0.11, < 7.1 | 7.1 |
| linux/linux_kernel | ≥ 7.1.1, < 7.1.4 | 7.1.4 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |