Linux: Use After Free
CVE-2026-64434 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions 8f90405a4a6f1f1880dc07996b47bf57c712bd8a, 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b, 8922c7940bae9ce4b1736dddb6362370793835c2 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.26% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 8f90405a4a6f1f1880dc07996b47bf57c712bd8a or 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b or 8922c7940bae9ce4b1736dddb6362370793835c2 or 91047a4396a8b1857a6f712a90cf33ec0012b189, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.10.265 or 5.15.216 or 6.1.183 or 6.6.145, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 3634cbdc2eb414b69ffa752ddbe5e0458518e321 up to, but not including, 8f90405a4a6f1f1880dc07996b47bf57c712bd8a; e1c100e2d61bd8c718b7d91fe3e050780a9bf72d up to, but not including, 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b; deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9 up to, but not including, 8922c7940bae9ce4b1736dddb6362370793835c2; 89dec92041717b027216e110599e4f6d6c921b79 up to, but not including, 91047a4396a8b1857a6f712a90cf33ec0012b189; 50dfec218808b148ab4247b1858031b7a32015c5 up to, but not including, 0b0e2bf39cf99e458d991b9df253727e036a7d7d; 859d3ace791ed878ae9ba5522c7844d960da8f88 up to, but not including, d3b739db5dc6f688a60d56da872fabaf65246032; 8c8e620467a7b51562dbcefbd1f09f288d7d710d up to, but not including, 50c38d9f42a529691e4e67ea9cedf4f0bfc8d277; 8c8e620467a7b51562dbcefbd1f09f288d7d710d up to, but not including, b66774b48dd98f07254951f74ea6f513efe7ff8b; and 9 more ranges | 8f90405a4a6f1f1880dc07996b47bf57c712bd8a, 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b, 8922c7940bae9ce4b1736dddb6362370793835c2, 91047a4396a8b1857a6f712a90cf33ec0012b189, 0b0e2bf39cf99e458d991b9df253727e036a7d7d, d3b739db5dc6f688a60d56da872fabaf65246032 |
| Linux | Linux Kernel | 5.10.259 up to, but not including, 5.10.265; 5.15.210 up to, but not including, 5.15.216; 6.1.176 up to, but not including, 6.1.183; 6.6.143 up to, but not including, 6.6.145; 6.12.93 up to, but not including, 6.12.97; 6.18.35 up to, but not including, 6.18.39; 7.0.12 up to, but not including, 7.1; 7.1.1 up to, but not including, 7.1.4; and 1 more ranges | 5.10.265, 5.15.216, 6.1.183, 6.6.145, 6.12.97, 6.18.39 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- AdjacentThe attacker must be on the same local network segment.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2cap_chan_timeout() runs asynchronously and accesses chan->conn. If the connection is torn down while the timer is running or pending, chan->conn can be freed, leading to a use-after-free when the timer worker attempts to lock conn->lock: | BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] | BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline] | BUG: KASAN: slab-use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:161 [inline] | BUG: KASAN: slab-use-after-free in mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318 | Write of size 8 at addr ffff8881298d9550 by task kworker/2:1/83 | | CPU: 2 UID: 0 PID: 83 Comm: kworker/2:1 Not tainted 7.1.0-rc6-next-20260601-dirty #6 PREEMPT(full) | Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 | Workqueue: events l2cap_chan_timeout | Call Trace: | <TASK> | instrument_atomic_read_write include/linux/instrumented.h:112 [inline] | atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline] | __mutex_trylock_fast kernel/locking/mutex.c:161 [inline] | mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318 | l2cap_chan_timeout+0x5d/0x1b0 net/bluetooth/l2cap_core.c:422 | process_one_work kernel/workqueue.c:3326 [inline] | process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409 | worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490 | kthread+0x346/0x430 kernel/kthread.c:436 | ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158 | ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 | </TASK> | | Allocated by task 320: | l2cap_conn_add+0xa7/0x820 net/bluetooth/l2cap_core.c:7075 | l2cap_connect_cfm+0xdb/0xd70 net/bluetooth/l2cap_core.c:7452 | hci_connect_cfm include/net/bluetooth/hci_core.h:2139 [inline] | hci_remote_features_evt+0x52f/0x9f0 net/bluetooth/hci_event.c:3760 | hci_event_func net/bluetooth/hci_event.c:7796 [inline] | hci_event_packet+0x561/0xa70 net/bluetooth/hci_event.c:7847 | hci_rx_work+0x370/0x890 net/bluetooth/hci_core.c:4040 | process_one_work kernel/workqueue.c:3326 [inline] | process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409 | worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490 | kthread+0x346/0x430 kernel/kthread.c:436 | ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158 | ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 | | Freed by task 322: | hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline] | hci_conn_hash_flush+0x101/0x1f0 net/bluetooth/hci_conn.c:2736 | hci_dev_close_sync+0x889/0xde0 net/bluetooth/hci_sync.c:5405 | hci_dev_do_close net/bluetooth/hci_core.c:502 [inline] | hci_unregister_dev+0x1f7/0x370 net/bluetooth/hci_core.c:2679 | vhci_release+0x12a/0x180 drivers/bluetooth/hci_vhci.c:690 | __fput+0x369/0x890 fs/file_table.c:510 | task_work_run+0x160/0x1d0 kernel/task_work.c:233 | get_signal+0xf5b/0x1120 kernel/signal.c:2810 | arch_do_signal_or_restart+0x4d/0x600 arch/x86/kernel/signal.c:337 | __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] | exit_to_user_mode_loop+0x85/0x510 kernel/entry/common.c:98 | do_syscall_64+0x263/0x3d0 arch/x86/entry/syscall_64.c:100 | entry_SYSCALL_64_after_hwframe+0x77/0x7f | | The buggy address belongs to the object at ffff8881298d9400 | which belongs to the cache kmalloc-512 of size 512 | The buggy address is located 336 bytes inside of | freed 512-byte region [ffff8881298d9400, ffff8881298d9600) Fix it by having chan->conn hold a reference to l2cap_conn (via l2cap_conn_get) when the channel is added to the connection, and releasing it in the channel destructor. This ensures the l2cap_conn remains alive as long as the channel exists. A new FLAG_DEL channel flag is introduced to indicate that the ch ---truncated---
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/0b0e2bf39cf99e458d991b9df253727e036a7d7d
- git.kernel.org/stable/c/32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b
- git.kernel.org/stable/c/50c38d9f42a529691e4e67ea9cedf4f0bfc8d277
- git.kernel.org/stable/c/8922c7940bae9ce4b1736dddb6362370793835c2
- git.kernel.org/stable/c/8f90405a4a6f1f1880dc07996b47bf57c712bd8a
- git.kernel.org/stable/c/91047a4396a8b1857a6f712a90cf33ec0012b189
- git.kernel.org/stable/c/b66774b48dd98f07254951f74ea6f513efe7ff8b
- git.kernel.org/stable/c/d3b739db5dc6f688a60d56da872fabaf65246032
Recent Use After Free vulnerabilities
- 9.8 Critical severity
- 7.8 High severity
- 8.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.