Re: [PATCH 6.1.y] Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
Sasha Levin <[email protected]>
| Newsgroups | org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On Thu, Aug 06, 2026 at 12:52:14AM +0000, Todd Kjos wrote: > l2cap_chan_timeout() runs asynchronously and accesses chan->conn. If > the connection is torn down while the timer is running or pending, > chan->conn can be freed, leading to a use-after-free when the timer > worker attempts to lock conn->lock: Queued for 6.1, thanks :) -- Thanks, Sasha