High 8.8Published Jul 25, 2026

CVE-2026-64408Bluetooth: bnep: pin L2CAP connection during netdev registration

Updated under an hour ago (Oct 29, 2026, 3:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for Linux Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a freed parent device. Take a reference to the L2CAP connection while holding the channel lock. Retain it until register_netdev() has taken the parent device reference.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 65f53e9802dbfae0e5758a91793c3f5f8bece49b before 390b5db3ff8745187f094c4e915663b7b1f98944; 65f53e9802dbfae0e5758a91793c3f5f8bece49b builds before 46a88784c4c9b96954dd86f747ce93f65efa1302; from 65f53e9802dbfae0e5758a91793c3f5f8bece49b before 551ae773ec64045b4e72099132654887e0270bcc; from 65f53e9802dbfae0e5758a91793c3f5f8bece49b before ae215c5b6422d8eda443b861b124bd1be6969c31; from 65f53e9802dbfae0e5758a91793c3f5f8bece49b before df22adc7eafc22e651561813c11dc51a796b12ee; from 65f53e9802dbfae0e5758a91793c3f5f8bece49b before a6b22dbd80926556290ad2243be25218d6956a19; from 65f53e9802dbfae0e5758a91793c3f5f8bece49b before 563a8573047182f550b1e1e030615755cd8c41da; from 65f53e9802dbfae0e5758a91793c3f5f8bece49b before bb067a99a0356196c0b89a95721985485ebce5a5	CNA record
linux linux_kernel linux:linux_kernel	from 3.13 before 5.10.261; from 5.11 before 5.15.212; from 5.16 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4; 7.2; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/390b5db3ff8745187f094c4e915663b7b1f98944	patch
https://git.kernel.org/stable/c/46a88784c4c9b96954dd86f747ce93f65efa1302	patch
https://git.kernel.org/stable/c/551ae773ec64045b4e72099132654887e0270bcc	patch
https://git.kernel.org/stable/c/ae215c5b6422d8eda443b861b124bd1be6969c31	patch
https://git.kernel.org/stable/c/df22adc7eafc22e651561813c11dc51a796b12ee	patch
https://git.kernel.org/stable/c/a6b22dbd80926556290ad2243be25218d6956a19	patch
https://git.kernel.org/stable/c/563a8573047182f550b1e1e030615755cd8c41da	patch
https://git.kernel.org/stable/c/bb067a99a0356196c0b89a95721985485ebce5a5	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.