01 Record

CVE-2026-64434

Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

HighPUBLISHEDCNA: Linux

CNA base score8.8 CVSS v3.xCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.26% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 16.7% of scored records. A rank, not a probability.
NVD base score: 8.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Analyzed. NVD last modified this record on 2026-09-03.
Red Hat severity: Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-07-25 08:51Z1 MO AGO

Last updated

2026-08-19 16:28Z16 DAYS AGO

Reserved

2026-07-19

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 8.8)

CNA CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-416Use After FreeVariant

Data version

5.2

Document digest

ef1e85e8503e901a05b003adab9c9343df8fb8d3903b9bb4e9711248791b9775

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux3634cbdc2eb414b69ffa752ddbe5e0458518e321 to < 8f90405a4a6f1f1880dc07996b47bf57c712bd8a, e1c100e2d61bd8c718b7d91fe3e050780a9bf72d to < 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b, deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9 to < 8922c7940bae9ce4b1736dddb6362370793835c2, 89dec92041717b027216e110599e4f6d6c921b79 to < 91047a4396a8b1857a6f712a90cf33ec0012b189, 50dfec218808b148ab4247b1858031b7a32015c5 to < 0b0e2bf39cf99e458d991b9df253727e036a7d7d, 859d3ace791ed878ae9ba5522c7844d960da8f88 to < d3b739db5dc6f688a60d56da872fabaf65246032, 8c8e620467a7b51562dbcefbd1f09f288d7d710d to < 50c38d9f42a529691e4e67ea9cedf4f0bfc8d277, 8c8e620467a7b51562dbcefbd1f09f288d7d710d to < b66774b48dd98f07254951f74ea6f513efe7ff8b, 7555fd885a0603f50e49a655850a1f2bd8a25398, 5.10.259 to < 5.10.265, 5.15.210 to < 5.15.216, 6.1.176 to < 6.1.183, 6.6.143 to < 6.6.145, 6.12.93 to < 6.12.97, 6.18.35 to < 6.18.39, 7.0.12 to < 7.1, 7.1—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/8f90405a4a6f1f1880dc07996b47bf57c712bd8a
git.kernel.orghttps://git.kernel.org/stable/c/32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b
git.kernel.orghttps://git.kernel.org/stable/c/8922c7940bae9ce4b1736dddb6362370793835c2
git.kernel.orghttps://git.kernel.org/stable/c/91047a4396a8b1857a6f712a90cf33ec0012b189
git.kernel.orghttps://git.kernel.org/stable/c/0b0e2bf39cf99e458d991b9df253727e036a7d7d
git.kernel.orghttps://git.kernel.org/stable/c/d3b739db5dc6f688a60d56da872fabaf65246032
git.kernel.orghttps://git.kernel.org/stable/c/50c38d9f42a529691e4e67ea9cedf4f0bfc8d277
git.kernel.orghttps://git.kernel.org/stable/c/b66774b48dd98f07254951f74ea6f513efe7ff8b

01 Record index

CVE-2026-64434

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2026-64434

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References