SECUFOCUSNOW
Home›CVE index›CVE-2026-64434
Review reviewHigh

CVE-2026-64434

Linux

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2cap_chan_timeout() runs asynchronously and accesses chan->conn. If the connection is torn down while the timer is running or pending, chan->conn can be freed, leading to a use-after-free when the timer worker attempts to lock conn->lock: | BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] | BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456...

CVSS
8.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.25
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 8.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2cap_chan_timeout() runs asynchronously and accesses chan->conn. If the connection is torn down while the timer is running or pending, chan->conn can be freed, leading to a use-after-free when the timer worker attempts to lock conn->lock: | BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] | BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456...

Affected product and versions

Product
Linux
Affected versions
>= 89dec92041717b027216e110599e4f6d6c921b79 < 91047a4396a8b1857a6f712a90cf33ec0012b189, >= 50dfec218808b148ab4247b1858031b7a32015c5 < 0b0e2bf39cf99e458d991b9df253727e036a7d7d, >= 859d3ace791ed878ae9ba5522c7844d960da8f88 < d3b739db5dc6f688a60d56da872fabaf65246032, >= 8c8e620467a7b51562dbcefbd1f09f288d7d710d < 50c38d9f42a529691e4e67ea9cedf4f0bfc8d277, >= 8c8e620467a7b51562dbcefbd1f09f288d7d710d < b66774b48dd98f07254951f74ea6f513efe7ff8b, >= 3634cbdc2eb414b69ffa752ddbe5e0458518e321, >= e1c100e2d61bd8c718b7d91fe3e050780a9bf72d, >= deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9, >= 7555fd885a0603f50e49a655850a1f2bd8a25398, >= 6.6.143 < 6.6.145, >= 6.12.93 < 6.12.97, >= 6.18.35 < 6.18.39, >= 5.10.259 < 5.11, >= 5.15.210 < 5.16, >= 6.1.176 < 6.2, >= 7.0.12 < 7.1, >= 7.1
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available
CVE-2026-64434 — Linux | SECUFOCUS NOW