CVE-2026-64406

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept_dequeue() bt_accept_get() takes a temporary reference before dropping the accept queue lock. bt_accept_dequeue() currently drops that reference before bt_accept_unlink(), leaving only the queue reference. bt_accept_unlink() drops the queue reference. The subsequent sock_hold() therefore accesses freed memory if it was the final reference, as observed by KASAN during listening L2CAP socket cleanup. Retain the temporary queue-walk reference through unlink and hand it to the caller on success. Drop it explicitly on the closed and not-yet-connected paths.

• CWE-416

• https://git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0Patch
• https://git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614Patch
• https://git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9aPatch
• https://git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049Patch
• https://git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1dbPatch
• https://git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547Patch
• https://git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8dPatch
• https://git.kernel.org/stable/c/c66a95e60b65d876a927123b0ed36bd6177d9ca6Patch

Published

Jul 25, 2026

Last Modified

Sep 4, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-64400In the Linux kernel, the following vulnerability has been re…8.6
• CVE-2026-64401In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64402In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64403In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-64404In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64405In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64407In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-64408In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-64409In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-6441The Canto plugin for WordPress is vulnerable to Missing Auth…4.3
• CVE-2026-64410In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-64411In the Linux kernel, the following vulnerability has been re…7.1