In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept_dequeue() bt_accept_get() takes a temporary reference before dropping the accept queue lock. bt_accept_dequeue() currently drops that reference before bt_accept_unlink(), leaving only the queue reference. bt_accept_unlink() drops the queue reference. The subsequent sock_hold() therefore accesses freed memory if it was the final reference, as observed by KASAN during listening L2CAP socket cleanup. Retain the temporary queue-walk reference through unlink and hand it to the caller on success. Drop it explicitly on the closed and not-yet-connected paths.

A flaw was found in the Linux kernel's Bluetooth subsystem. This use-after-free (UAF) vulnerability in the `bt_accept_dequeue()` function occurs because a temporary reference is prematurely dropped, leading to `sock_hold()` accessing freed memory. An attacker could potentially exploit this to cause a denial of service (DoS) or other unpredictable system behavior.

Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat Hardened Images Not affected erlang27 https://www.cve.org/CVERecord?id=CVE-2026-64406 https://nvd.nist.gov/vuln/detail/CVE-2026-64406 https://lore.kernel.org/linux-cve-announce/2026072531-CVE-2026-64406-daf2@gregkh/T