CVE-2026-64406: Bluetooth: fix UAF in bt_accept_dequeue()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: fix UAF in bt_accept_dequeue()

bt_accept_get() takes a temporary reference before dropping the accept
queue lock. bt_accept_dequeue() currently drops that reference before
bt_accept_unlink(), leaving only the queue reference.

bt_accept_unlink() drops the queue reference. The subsequent
sock_hold() therefore accesses freed memory if it was the final
reference, as observed by KASAN during listening L2CAP socket cleanup.

Retain the temporary queue-walk reference through unlink and hand it to
the caller on success. Drop it explicitly on the closed and
not-yet-connected paths.

The Linux kernel CVE team has assigned CVE-2026-64406 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10.259 with commit 751de6ec671fe75ad9cf65a0638d2a06b6a5984d and fixed in 5.10.261 with commit c0577c55219be42b6ea2ea8db11e85bfab6f4e8d
	Issue introduced in 5.15.210 with commit 407217734835d21d4e0105ebf347860dc1806f88 and fixed in 5.15.212 with commit 96ad400d5132eb333f28f6f1e2d58f0728ca9547
	Issue introduced in 6.1.175 with commit 7eebd4c2c86f573af87ff165d08a83432eb0b919 and fixed in 6.1.178 with commit 0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0
	Issue introduced in 6.6.142 with commit 5d86d2f1b4d9a508c441d3e45277ae1a73cfed57 and fixed in 6.6.145 with commit c66a95e60b65d876a927123b0ed36bd6177d9ca6
	Issue introduced in 6.12.92 with commit 87c543e2f78d0871f271df92dab98901bbd5b6f5 and fixed in 6.12.96 with commit 6303ed4bbe0095f4cc195225479bf506e010d1db
	Issue introduced in 6.18.34 with commit added1213395071470a900cc845a042fb51882a6 and fixed in 6.18.39 with commit 26168db1ce5a9766cde021b18e590a101c056614
	Issue introduced in 7.1 with commit ab1513597c6cf17cd1ad2a21e3b045421b48e022 and fixed in 7.1.4 with commit 50c662bdcd51b03033a0abed6716bfd377ba1049
	Issue introduced in 7.1 with commit ab1513597c6cf17cd1ad2a21e3b045421b48e022 and fixed in 7.2-rc3 with commit 4bd0b274054f2679f28b70222b607bb0afc3ab9a
	Issue introduced in 7.0.11 with commit a5ca86a6097a8b030ca3226cd300b17ed330f966

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64406
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bluetooth/af_bluetooth.c
	net/bluetooth/l2cap_sock.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8d
	https://git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547
	https://git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0
	https://git.kernel.org/stable/c/c66a95e60b65d876a927123b0ed36bd6177d9ca6
	https://git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1db
	https://git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614
	https://git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049
	https://git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9a