CVE-2026-64408

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: bnep: pin L2CAP connection during netdev registration<br /> <br /> bnep_add_connection() reads the L2CAP connection without holding the<br /> channel lock, then passes its HCI device to register_netdev(). Controller<br /> teardown can clear and release that connection concurrently, leaving the<br /> network device registration path to dereference a freed parent device.<br /> <br /> Take a reference to the L2CAP connection while holding the channel lock.<br /> Retain it until register_netdev() has taken the parent device reference.