CVE-2026-63948
Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn __set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold() before scheduling the delayed work. The normal path in l2cap_chan_timeout() drops this reference with l2cap_chan_put() at the end, but the early return when chan->conn is NULL skips the put, leaking the reference. Add the missing l2cap_chan_put() before the early return.
INFO
Published Date :
July 19, 2026, 4:17 p.m.
Last Modified :
July 27, 2026, 5:44 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Apply the kernel patch to increment reference count.
- Review and test the patch thoroughly.
- Update the Linux kernel to the patched version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-63948.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-63948 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-63948
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-63948 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-63948 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '06acb75e7ed600d0bbf7bff5628aa8f24a97978c', 'lessThan': '50f1bcaaaa3a80bb1c3472044bc146e8d49d51ee', 'versionType': 'git'}, {'status': 'affected', 'version': 'e97e16433eb4533083b096a3824b93a5ca3aee79', 'lessThan': 'b5c59a5b469e2a809a2d57eda4ded94235971060', 'versionType': 'git'}, {'status': 'affected', 'version': '8960ff650aec70485b40771cd8e6e8c4cb467d33', 'lessThan': '8894c2010435a56ce7c6c2a8785860c13554df2f', 'versionType': 'git'}, {'status': 'affected', 'version': '955b5b6c54d95b5e7444dfc81c95c8e013f27ac0', 'lessThan': '63cd225cc13d782a85e2a73c04d0d350153eada1', 'versionType': 'git'}, {'status': 'affected', 'version': 'adf0398cee86643b8eacde95f17d073d022f782c', 'lessThan': '107c826e4ef9ec5ad8f60e6fe64d8d5325ba508f', 'versionType': 'git'}, {'status': 'affected', 'version': 'adf0398cee86643b8eacde95f17d073d022f782c', 'lessThan': 'e8a5baff5be273ca07771fd2b9bb1f2a4152917b', 'versionType': 'git'}, {'status': 'affected', 'version': 'adf0398cee86643b8eacde95f17d073d022f782c', 'lessThan': '08d81fe96f80a8e20c7acb573b6a45d901fcf2cd', 'versionType': 'git'}, {'status': 'affected', 'version': 'adf0398cee86643b8eacde95f17d073d022f782c', 'lessThan': '9dbd84990394c51f5cee1e8871bb5ff8af5ed939', 'versionType': 'git'}, {'status': 'affected', 'version': 'e137e2ba96e51902dc2878131823a96bf8e638ae', 'versionType': 'git'}, {'status': 'affected', 'version': '6466ee65e5b27161c846c73ef407f49dfa1bd1d9', 'versionType': 'git'}, {'status': 'affected', 'version': 'eb86f955488c39526534211f2610e48a5cf8ead4', 'versionType': 'git'}, {'status': 'affected', 'version': '5.10.217', 'lessThan': '5.10.259', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.15.159', 'lessThan': '5.15.210', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.91', 'lessThan': '6.1.176', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.6.31', 'lessThan': '6.6.143', 'versionType': 'semver'}, {'status': 'affected', 'version': '4.19.314', 'lessThan': '4.20', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.4.276', 'lessThan': '5.5', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.8.10', 'lessThan': '6.9', 'versionType': 'semver'}], 'programFiles': ['net/bluetooth/l2cap_core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.9'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.9', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/bluetooth/l2cap_core.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn __set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold() before scheduling the delayed work. The normal path in l2cap_chan_timeout() drops this reference with l2cap_chan_put() at the end, but the early return when chan->conn is NULL skips the put, leaking the reference. Add the missing l2cap_chan_put() before the early return. Added Reference https://git.kernel.org/stable/c/08d81fe96f80a8e20c7acb573b6a45d901fcf2cd Added Reference https://git.kernel.org/stable/c/107c826e4ef9ec5ad8f60e6fe64d8d5325ba508f Added Reference https://git.kernel.org/stable/c/50f1bcaaaa3a80bb1c3472044bc146e8d49d51ee Added Reference https://git.kernel.org/stable/c/63cd225cc13d782a85e2a73c04d0d350153eada1 Added Reference https://git.kernel.org/stable/c/8894c2010435a56ce7c6c2a8785860c13554df2f Added Reference https://git.kernel.org/stable/c/9dbd84990394c51f5cee1e8871bb5ff8af5ed939 Added Reference https://git.kernel.org/stable/c/b5c59a5b469e2a809a2d57eda4ded94235971060 Added Reference https://git.kernel.org/stable/c/e8a5baff5be273ca07771fd2b9bb1f2a4152917b