Re: [PATCH] Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp

[email protected] Fri, 24 Jul 2026 19:00:13 +0000

Newsgroups	org.kernel.vger.linux-bluetooth,org.kernel.vger.linux-kernel
Message-ID	<178491961338.3273549.6968259035260624950.git-patchwork-notify@kernel.org>

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[email protected]>:

On Thu, 23 Jul 2026 14:48:45 +0800 you wrote:
> l2cap_le_connect_rsp() obtains a channel via
> __l2cap_get_chan_by_ident() but neither holds a reference nor uses
> l2cap_chan_hold_unless_zero() before locking and operating on it.
> A concurrent l2cap_chan_del() triggered by a remote disconnect can
> free the channel between the lookup and l2cap_chan_lock(), causing
> a use-after-free.
> 
> [...]

Here is the summary with links:
  - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
    https://git.kernel.org/bluetooth/bluetooth-next/c/5de0af8b2ace

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html