01 Record

CVE-2026-64434

Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

HighPUBLISHEDCNA: Linux

CNA base score8.8 CVSS v3.xCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.25% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 17.0% of scored records. A rank, not a probability.

NVD base score

8.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-19.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-07-25 08:51Z3 MO AGO

Last updated

2026-10-19 20:38Z9 DAYS AGO

Reserved

2026-07-19

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 8.8)

CNA CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-416Use After FreeVariant

Data version

5.2

Document digest

4948bd2198d6524e76674fbf962caf4bbe898b90bfb68d10c799bad4b4a3b3b0

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux3634cbdc2eb414b69ffa752ddbe5e0458518e321 to < 8f90405a4a6f1f1880dc07996b47bf57c712bd8a, e1c100e2d61bd8c718b7d91fe3e050780a9bf72d to < 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b, deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9 to < 8922c7940bae9ce4b1736dddb6362370793835c2, 89dec92041717b027216e110599e4f6d6c921b79 to < 91047a4396a8b1857a6f712a90cf33ec0012b189, 50dfec218808b148ab4247b1858031b7a32015c5 to < 0b0e2bf39cf99e458d991b9df253727e036a7d7d, 859d3ace791ed878ae9ba5522c7844d960da8f88 to < d3b739db5dc6f688a60d56da872fabaf65246032, 8c8e620467a7b51562dbcefbd1f09f288d7d710d to < 50c38d9f42a529691e4e67ea9cedf4f0bfc8d277, 8c8e620467a7b51562dbcefbd1f09f288d7d710d to < b66774b48dd98f07254951f74ea6f513efe7ff8b, 7555fd885a0603f50e49a655850a1f2bd8a25398, 5.10.259 to < 5.10.265, 5.15.210 to < 5.15.216, 6.1.176 to < 6.1.183, 6.6.143 to < 6.6.145, 6.12.93 to < 6.12.97, 6.18.35 to < 6.18.39, 7.0.12 to < 7.1, 7.1—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/8f90405a4a6f1f1880dc07996b47bf57c712bd8a
git.kernel.orghttps://git.kernel.org/stable/c/32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b
git.kernel.orghttps://git.kernel.org/stable/c/8922c7940bae9ce4b1736dddb6362370793835c2
git.kernel.orghttps://git.kernel.org/stable/c/91047a4396a8b1857a6f712a90cf33ec0012b189
git.kernel.orghttps://git.kernel.org/stable/c/0b0e2bf39cf99e458d991b9df253727e036a7d7d
git.kernel.orghttps://git.kernel.org/stable/c/d3b739db5dc6f688a60d56da872fabaf65246032
git.kernel.orghttps://git.kernel.org/stable/c/50c38d9f42a529691e4e67ea9cedf4f0bfc8d277
git.kernel.orghttps://git.kernel.org/stable/c/b66774b48dd98f07254951f74ea6f513efe7ff8b

07 Fixed in

Debian 12

linux
Fixed in 6.1.187-1
linux-6.12
Fixed in 6.12.100-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.100-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.4-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.