CVE-2026-23462

A flaw was found in the Linux kernel's Bluetooth subsystem (HIDP). A local attacker can exploit a use-after-free vulnerability by failing to properly drop a reference to an L2CAP (Logical Link Control and Adaptation Protocol) connection during a user removal callback. This memory corruption flaw may lead to a system crash, resulting in a Denial of Service (DoS).

HIDP did not drop the l2cap_conn reference when the user remove callback ran, so the connection could be freed while still referenced. Reproducers used vhci; real systems need Bluetooth HID profile use. Primary outcome is use-after-free and possible crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.