CVE-2026-64408
Bluetooth: bnep: pin L2CAP connection during netdev registration
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a freed parent device. Take a reference to the L2CAP connection while holding the channel lock. Retain it until register_netdev() has taken the parent device reference.
INFO
Published Date :
July 25, 2026, 10:17 a.m.
Last Modified :
July 25, 2026, 10:17 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-64408
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Take reference to L2CAP connection with channel lock.
- Retain reference until netdev registration is complete.
- Update Linux kernel to include the fix.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64408.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64408 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64408
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64408 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64408 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '65f53e9802dbfae0e5758a91793c3f5f8bece49b', 'lessThan': '390b5db3ff8745187f094c4e915663b7b1f98944', 'versionType': 'git'}, {'status': 'affected', 'version': '65f53e9802dbfae0e5758a91793c3f5f8bece49b', 'lessThan': '46a88784c4c9b96954dd86f747ce93f65efa1302', 'versionType': 'git'}, {'status': 'affected', 'version': '65f53e9802dbfae0e5758a91793c3f5f8bece49b', 'lessThan': '551ae773ec64045b4e72099132654887e0270bcc', 'versionType': 'git'}, {'status': 'affected', 'version': '65f53e9802dbfae0e5758a91793c3f5f8bece49b', 'lessThan': 'ae215c5b6422d8eda443b861b124bd1be6969c31', 'versionType': 'git'}, {'status': 'affected', 'version': '65f53e9802dbfae0e5758a91793c3f5f8bece49b', 'lessThan': 'df22adc7eafc22e651561813c11dc51a796b12ee', 'versionType': 'git'}, {'status': 'affected', 'version': '65f53e9802dbfae0e5758a91793c3f5f8bece49b', 'lessThan': 'a6b22dbd80926556290ad2243be25218d6956a19', 'versionType': 'git'}, {'status': 'affected', 'version': '65f53e9802dbfae0e5758a91793c3f5f8bece49b', 'lessThan': '563a8573047182f550b1e1e030615755cd8c41da', 'versionType': 'git'}, {'status': 'affected', 'version': '65f53e9802dbfae0e5758a91793c3f5f8bece49b', 'lessThan': 'bb067a99a0356196c0b89a95721985485ebce5a5', 'versionType': 'git'}], 'programFiles': ['net/bluetooth/bnep/core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.13'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.13', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.96', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.39', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.4', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/bluetooth/bnep/core.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a freed parent device. Take a reference to the L2CAP connection while holding the channel lock. Retain it until register_netdev() has taken the parent device reference. Added Reference https://git.kernel.org/stable/c/390b5db3ff8745187f094c4e915663b7b1f98944 Added Reference https://git.kernel.org/stable/c/46a88784c4c9b96954dd86f747ce93f65efa1302 Added Reference https://git.kernel.org/stable/c/551ae773ec64045b4e72099132654887e0270bcc Added Reference https://git.kernel.org/stable/c/563a8573047182f550b1e1e030615755cd8c41da Added Reference https://git.kernel.org/stable/c/a6b22dbd80926556290ad2243be25218d6956a19 Added Reference https://git.kernel.org/stable/c/ae215c5b6422d8eda443b861b124bd1be6969c31 Added Reference https://git.kernel.org/stable/c/bb067a99a0356196c0b89a95721985485ebce5a5 Added Reference https://git.kernel.org/stable/c/df22adc7eafc22e651561813c11dc51a796b12ee