CVE-2026-63948

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn<br /> <br /> __set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold()<br /> before scheduling the delayed work. The normal path in<br /> l2cap_chan_timeout() drops this reference with l2cap_chan_put() at the<br /> end, but the early return when chan-&gt;conn is NULL skips the put,<br /> leaking the reference.<br /> <br /> Add the missing l2cap_chan_put() before the early return.