CVE-2026-63948
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn __set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold() before scheduling the delayed work. The normal path in l2cap_chan_timeout() drops this reference with l2cap_chan_put() at the end, but the early return when chan->conn is NULL skips the put, leaking the reference. Add the missing l2cap_chan_put() before the early return.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 06acb75e7ed600d0bbf7bff5628aa8f24a97978c | affected | git | 50f1bcaaaa3a80bb1c3472044bc146e8d49d51ee | Unavailable | None listed |
| e97e16433eb4533083b096a3824b93a5ca3aee79 | affected | git | b5c59a5b469e2a809a2d57eda4ded94235971060 | Unavailable | None listed |
| 8960ff650aec70485b40771cd8e6e8c4cb467d33 | affected | git | 8894c2010435a56ce7c6c2a8785860c13554df2f | Unavailable | None listed |
| 955b5b6c54d95b5e7444dfc81c95c8e013f27ac0 | affected | git | 63cd225cc13d782a85e2a73c04d0d350153eada1 | Unavailable | None listed |
| adf0398cee86643b8eacde95f17d073d022f782c | affected | git | 107c826e4ef9ec5ad8f60e6fe64d8d5325ba508f | Unavailable | None listed |
| adf0398cee86643b8eacde95f17d073d022f782c | affected | git | e8a5baff5be273ca07771fd2b9bb1f2a4152917b | Unavailable | None listed |
| adf0398cee86643b8eacde95f17d073d022f782c | affected | git | 08d81fe96f80a8e20c7acb573b6a45d901fcf2cd | Unavailable | None listed |
| adf0398cee86643b8eacde95f17d073d022f782c | affected | git | 9dbd84990394c51f5cee1e8871bb5ff8af5ed939 | Unavailable | None listed |
| e137e2ba96e51902dc2878131823a96bf8e638ae | affected | git | Unavailable | Unavailable | None listed |
| 6466ee65e5b27161c846c73ef407f49dfa1bd1d9 | affected | git | Unavailable | Unavailable | None listed |
| eb86f955488c39526534211f2610e48a5cf8ead4 | affected | git | Unavailable | Unavailable | None listed |
| 5.10.217 | affected | semver | 5.10.259 | Unavailable | None listed |
| 5.15.159 | affected | semver | 5.15.210 | Unavailable | None listed |
| 6.1.91 | affected | semver | 6.1.176 | Unavailable | None listed |
| 6.6.31 | affected | semver | 6.6.143 | Unavailable | None listed |
| 4.19.314 | affected | semver | 4.20 | Unavailable | None listed |
| 5.4.276 | affected | semver | 5.5 | Unavailable | None listed |
| 6.8.10 | affected | semver | 6.9 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 6.9 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 6.9 | Unavailable | None listed |
| 5.10.259 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.210 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.176 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.143 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.93 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.35 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.0.12 | unaffected | semver | Unavailable | 7.0.* | None listed |
| 7.1 | unaffected | original_commit_for_fix | Unavailable | * | None listed |