CVE-2026-64557: 
Linux Kernel Schwachstellenanalyse und -minderung

CVE-2026-64557 is a use-after-free vulnerability in the Linux kernel's Bluetooth L2CAP subsystem, specifically in the l2cap_sock_new_connection_cb() function. The flaw exists because the function dereferences a child socket pointer (l2cap_pi(sk)->chan) after releasing the parent socket lock (release_sock(parent)), allowing a concurrent task to accept and free the child socket before the callback completes. The vulnerability affects the Linux kernel from version 3.13 onward, with fixes available in stable releases 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3. It was disclosed on July 29, 2026, and carries a CVSS v3.1 base score of 7.0 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-416 (Use After Free) / CWE-825 (Expired Pointer Dereference). In l2cap_sock_new_connection_cb(), the newly created child socket is enqueued into the parent's accept queue before release_sock(parent) is called; once the parent lock is dropped, another task can call accept() and free the child socket, while the callback still holds a stale pointer to it and subsequently dereferences it. The fix reworks the ->new_connection() operation so that the L2CAP core — rather than the callback — owns the child channel's lifetime: l2cap_new_connection() now allocates the child channel and links it into the connection list via __l2cap_chan_add() before invoking the callback, ensuring the conn-list reference keeps the channel alive. Channel configuration previously duplicated across l2cap_sock_init() and various new_connection callbacks is consolidated into l2cap_chan_set_defaults() (Red Hat Advisory, GitHub Advisory).

Successful exploitation allows a local attacker with the ability to create Bluetooth L2CAP connections to trigger a use-after-free condition, potentially leading to arbitrary code execution with kernel privileges. The confidentiality, integrity, and availability impacts are all rated High, meaning an attacker could read sensitive kernel memory, corrupt kernel data structures, or crash the system. Because exploitation results in kernel-level code execution, it could enable full system compromise and lateral movement within a host (Red Hat Advisory, GitHub Advisory).

Update the Linux kernel to one of the following patched stable versions: 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc3 (or later). Linux distribution vendors (e.g., Red Hat, Debian, Ubuntu) are expected to backport the fix into their respective kernel packages; apply vendor-provided updates as soon as they become available. As a temporary risk reduction measure on systems where Bluetooth is not required, disabling the Bluetooth subsystem or blocking L2CAP socket creation can reduce the attack surface (Red Hat Advisory, GitHub Advisory).