Bluetooth: bnep: pin L2CAP connection during netdev registration

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a freed parent device. Take a reference to the L2CAP connection while holding the channel lock. Retain it until register_netdev() has taken the parent device reference.

Timeline

1. Jul 25, 2026, 8:50 AM UTCCVE published
2. Oct 16, 2026, 3:40 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 19, 2026, 8:38 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 65f53e9802dbfae0e5758a91793c3f5f8bece49b · fixed in 390b5db3ff8745187f094c4e915663b7b1f98944; From 65f53e9802dbfae0e5758a91793c3f5f8bece49b · fixed in 46a88784c4c9b96954dd86f747ce93f65efa1302; From 65f53e9802dbfae0e5758a91793c3f5f8bece49b · fixed in 551ae773ec64045b4e72099132654887e0270bcc; From 65f53e9802dbfae0e5758a91793c3f5f8bece49b · fixed in ae215c5b6422d8eda443b861b124bd1be6969c31; From 65f53e9802dbfae0e5758a91793c3f5f8bece49b · fixed in df22adc7eafc22e651561813c11dc51a796b12ee; From 65f53e9802dbfae0e5758a91793c3f5f8bece49b · fixed in a6b22dbd80926556290ad2243be25218d6956a19; From 65f53e9802dbfae0e5758a91793c3f5f8bece49b · fixed in 563a8573047182f550b1e1e030615755cd8c41da; From 65f53e9802dbfae0e5758a91793c3f5f8bece49b · fixed in bb067a99a0356196c0b89a95721985485ebce5a5

• Linux Linux

  3.13

• KernelLinux

  From 3.13.0 · fixed in 5.10.261; From 5.11.0 · fixed in 5.15.212; From 5.16.0 · fixed in 6.1.178; From 6.2.0 · fixed in 6.6.145; From 6.7.0 · fixed in 6.12.96; From 6.13.0 · fixed in 6.18.39; From 6.19.0 · fixed in 7.1.4

References 8