01 Record

CVE-2026-63948

Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

UnratedPUBLISHEDCNA: Linux

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.21% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 11.1% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Awaiting Analysis. NVD last modified this record on 2026-07-27.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-07-19 14:55Z3 MO AGO

Last updated

2026-07-19 14:55Z3 MO AGO

Reserved

2026-07-19

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-911Improper Update of Reference CountBase

Data version

5.2

Document digest

0e20195eeb7f33c825887fd8c7ad940b13160e1f4eeece3224b269da72f98487

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux06acb75e7ed600d0bbf7bff5628aa8f24a97978c to < 50f1bcaaaa3a80bb1c3472044bc146e8d49d51ee, e97e16433eb4533083b096a3824b93a5ca3aee79 to < b5c59a5b469e2a809a2d57eda4ded94235971060, 8960ff650aec70485b40771cd8e6e8c4cb467d33 to < 8894c2010435a56ce7c6c2a8785860c13554df2f, 955b5b6c54d95b5e7444dfc81c95c8e013f27ac0 to < 63cd225cc13d782a85e2a73c04d0d350153eada1, adf0398cee86643b8eacde95f17d073d022f782c to < 107c826e4ef9ec5ad8f60e6fe64d8d5325ba508f, adf0398cee86643b8eacde95f17d073d022f782c to < e8a5baff5be273ca07771fd2b9bb1f2a4152917b, adf0398cee86643b8eacde95f17d073d022f782c to < 08d81fe96f80a8e20c7acb573b6a45d901fcf2cd, adf0398cee86643b8eacde95f17d073d022f782c to < 9dbd84990394c51f5cee1e8871bb5ff8af5ed939, e137e2ba96e51902dc2878131823a96bf8e638ae, 6466ee65e5b27161c846c73ef407f49dfa1bd1d9, eb86f955488c39526534211f2610e48a5cf8ead4, 5.10.217 to < 5.10.259, 5.15.159 to < 5.15.210, 6.1.91 to < 6.1.176, 6.6.31 to < 6.6.143, 4.19.314 to < 4.20, 5.4.276 to < 5.5, 6.8.10 to < 6.9, 6.9—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/50f1bcaaaa3a80bb1c3472044bc146e8d49d51ee
git.kernel.orghttps://git.kernel.org/stable/c/b5c59a5b469e2a809a2d57eda4ded94235971060
git.kernel.orghttps://git.kernel.org/stable/c/8894c2010435a56ce7c6c2a8785860c13554df2f
git.kernel.orghttps://git.kernel.org/stable/c/63cd225cc13d782a85e2a73c04d0d350153eada1
git.kernel.orghttps://git.kernel.org/stable/c/107c826e4ef9ec5ad8f60e6fe64d8d5325ba508f
git.kernel.orghttps://git.kernel.org/stable/c/e8a5baff5be273ca07771fd2b9bb1f2a4152917b
git.kernel.orghttps://git.kernel.org/stable/c/08d81fe96f80a8e20c7acb573b6a45d901fcf2cd
git.kernel.orghttps://git.kernel.org/stable/c/9dbd84990394c51f5cee1e8871bb5ff8af5ed939

07 Fixed in

Debian 12

linux
Fixed in 6.1.176-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.94-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.0.12-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.