{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-64406",
  "modified": "2026-10-07T14:35:31Z",
  "upstream": [
    "CVE-2026-64406"
  ],
  "published": "2026-07-25T08:51:45Z",
  "summary": "Bluetooth: fix UAF in bt_accept_dequeue()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix UAF in bt_accept_dequeue()\n\nbt_accept_get() takes a temporary reference before dropping the accept\nqueue lock. bt_accept_dequeue() currently drops that reference before\nbt_accept_unlink(), leaving only the queue reference.\n\nbt_accept_unlink() drops the queue reference. The subsequent\nsock_hold() therefore accesses freed memory if it was the final\nreference, as observed by KASAN during listening L2CAP socket cleanup.\n\nRetain the temporary queue-walk reference through unlink and hand it to\nthe caller on success. Drop it explicitly on the closed and\nnot-yet-connected paths.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.12.93-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.12.93+rpt-rpi-2712",
            "binary_version": "1:6.12.93-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.93+rpt-rpi-v6",
            "binary_version": "1:6.12.93-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.93+rpt-rpi-v7",
            "binary_version": "1:6.12.93-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.93+rpt-rpi-v7l",
            "binary_version": "1:6.12.93-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.93+rpt-rpi-v8",
            "binary_version": "1:6.12.93-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.93+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.93-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.12.93-1+rpt1": {
            "linux_commit": "d8ab4e908235da7727f22dd36ad5af224671677d",
            "upstream_version": "6.12.93",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.96"
          }
        }
      }
    },
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:13",
        "name": "linux"
      },
      "versions": [
        "1:6.18.34-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.18.34+rpt-rpi-2712",
            "binary_version": "1:6.18.34-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.34+rpt-rpi-v6",
            "binary_version": "1:6.18.34-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.34+rpt-rpi-v7",
            "binary_version": "1:6.18.34-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.34+rpt-rpi-v8",
            "binary_version": "1:6.18.34-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt",
            "binary_version": "1:6.18.34-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.18.34-1+rpt1": {
            "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af",
            "upstream_version": "6.18.34",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.18.39"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64406"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/c66a95e60b65d876a927123b0ed36bd6177d9ca6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1db"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9a"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-17T05:24:08Z"
  }
}