0.0
NA
CVE-2026-64408
Bluetooth: bnep: pin L2CAP connection during netdev registration
Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a freed parent device. Take a reference to the L2CAP connection while holding the channel lock. Retain it until register_netdev() has taken the parent device reference.

INFO

Published Date :

July 25, 2026, 10:17 a.m.

Last Modified :

July 25, 2026, 10:17 a.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-64408 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

No affected product recoded yet

Solution
Take a reference to the L2CAP connection while holding the channel lock until netdev registration is complete.
  • Take reference to L2CAP connection with channel lock.
  • Retain reference until netdev registration is complete.
  • Update Linux kernel to include the fix.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-64408 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-64408 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-64408 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-64408 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 25, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '65f53e9802dbfae0e5758a91793c3f5f8bece49b', 'lessThan': '390b5db3ff8745187f094c4e915663b7b1f98944', 'versionType': 'git'}, {'status': 'affected', 'version': '65f53e9802dbfae0e5758a91793c3f5f8bece49b', 'lessThan': '46a88784c4c9b96954dd86f747ce93f65efa1302', 'versionType': 'git'}, {'status': 'affected', 'version': '65f53e9802dbfae0e5758a91793c3f5f8bece49b', 'lessThan': '551ae773ec64045b4e72099132654887e0270bcc', 'versionType': 'git'}, {'status': 'affected', 'version': '65f53e9802dbfae0e5758a91793c3f5f8bece49b', 'lessThan': 'ae215c5b6422d8eda443b861b124bd1be6969c31', 'versionType': 'git'}, {'status': 'affected', 'version': '65f53e9802dbfae0e5758a91793c3f5f8bece49b', 'lessThan': 'df22adc7eafc22e651561813c11dc51a796b12ee', 'versionType': 'git'}, {'status': 'affected', 'version': '65f53e9802dbfae0e5758a91793c3f5f8bece49b', 'lessThan': 'a6b22dbd80926556290ad2243be25218d6956a19', 'versionType': 'git'}, {'status': 'affected', 'version': '65f53e9802dbfae0e5758a91793c3f5f8bece49b', 'lessThan': '563a8573047182f550b1e1e030615755cd8c41da', 'versionType': 'git'}, {'status': 'affected', 'version': '65f53e9802dbfae0e5758a91793c3f5f8bece49b', 'lessThan': 'bb067a99a0356196c0b89a95721985485ebce5a5', 'versionType': 'git'}], 'programFiles': ['net/bluetooth/bnep/core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.13'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.13', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.96', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.39', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.4', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/bluetooth/bnep/core.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a freed parent device. Take a reference to the L2CAP connection while holding the channel lock. Retain it until register_netdev() has taken the parent device reference.
    Added Reference https://git.kernel.org/stable/c/390b5db3ff8745187f094c4e915663b7b1f98944
    Added Reference https://git.kernel.org/stable/c/46a88784c4c9b96954dd86f747ce93f65efa1302
    Added Reference https://git.kernel.org/stable/c/551ae773ec64045b4e72099132654887e0270bcc
    Added Reference https://git.kernel.org/stable/c/563a8573047182f550b1e1e030615755cd8c41da
    Added Reference https://git.kernel.org/stable/c/a6b22dbd80926556290ad2243be25218d6956a19
    Added Reference https://git.kernel.org/stable/c/ae215c5b6422d8eda443b861b124bd1be6969c31
    Added Reference https://git.kernel.org/stable/c/bb067a99a0356196c0b89a95721985485ebce5a5
    Added Reference https://git.kernel.org/stable/c/df22adc7eafc22e651561813c11dc51a796b12ee
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.