CVE-2026-64408: Bluetooth: bnep: pin L2CAP connection during netdev registration

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bnep: pin L2CAP connection during netdev registration

bnep_add_connection() reads the L2CAP connection without holding the
channel lock, then passes its HCI device to register_netdev(). Controller
teardown can clear and release that connection concurrently, leaving the
network device registration path to dereference a freed parent device.

Take a reference to the L2CAP connection while holding the channel lock.
Retain it until register_netdev() has taken the parent device reference.

The Linux kernel CVE team has assigned CVE-2026-64408 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.13 with commit 65f53e9802dbfae0e5758a91793c3f5f8bece49b and fixed in 5.10.261 with commit 390b5db3ff8745187f094c4e915663b7b1f98944
	Issue introduced in 3.13 with commit 65f53e9802dbfae0e5758a91793c3f5f8bece49b and fixed in 5.15.212 with commit 46a88784c4c9b96954dd86f747ce93f65efa1302
	Issue introduced in 3.13 with commit 65f53e9802dbfae0e5758a91793c3f5f8bece49b and fixed in 6.1.178 with commit 551ae773ec64045b4e72099132654887e0270bcc
	Issue introduced in 3.13 with commit 65f53e9802dbfae0e5758a91793c3f5f8bece49b and fixed in 6.6.145 with commit ae215c5b6422d8eda443b861b124bd1be6969c31
	Issue introduced in 3.13 with commit 65f53e9802dbfae0e5758a91793c3f5f8bece49b and fixed in 6.12.96 with commit df22adc7eafc22e651561813c11dc51a796b12ee
	Issue introduced in 3.13 with commit 65f53e9802dbfae0e5758a91793c3f5f8bece49b and fixed in 6.18.39 with commit a6b22dbd80926556290ad2243be25218d6956a19
	Issue introduced in 3.13 with commit 65f53e9802dbfae0e5758a91793c3f5f8bece49b and fixed in 7.1.4 with commit 563a8573047182f550b1e1e030615755cd8c41da
	Issue introduced in 3.13 with commit 65f53e9802dbfae0e5758a91793c3f5f8bece49b and fixed in 7.2-rc3 with commit bb067a99a0356196c0b89a95721985485ebce5a5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64408
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bluetooth/bnep/core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/390b5db3ff8745187f094c4e915663b7b1f98944
	https://git.kernel.org/stable/c/46a88784c4c9b96954dd86f747ce93f65efa1302
	https://git.kernel.org/stable/c/551ae773ec64045b4e72099132654887e0270bcc
	https://git.kernel.org/stable/c/ae215c5b6422d8eda443b861b124bd1be6969c31
	https://git.kernel.org/stable/c/df22adc7eafc22e651561813c11dc51a796b12ee
	https://git.kernel.org/stable/c/a6b22dbd80926556290ad2243be25218d6956a19
	https://git.kernel.org/stable/c/563a8573047182f550b1e1e030615755cd8c41da
	https://git.kernel.org/stable/c/bb067a99a0356196c0b89a95721985485ebce5a5