CVE-2026-63948

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) component. A reference leak occurs in the l2cap_chan_timeout() function. When a channel's connection is null, an early exit path in the function fails to release a held channel reference. This oversight can lead to resource exhaustion over time, potentially causing system instability or a Denial of Service (DoS).

This vulnerability is rated as having a Moderate impact because exploitation requires local access and is confined to denial of service through resource exhaustion, leaving system confidentiality and integrity intact. Typical enterprise deployments of Red Hat Enterprise Linux do not utilize Bluetooth devices or maintain active Bluetooth networking, which minimizes exposure under standard server configurations. However, environments where the Bluetooth subsystem is active and accessible by local users may experience degraded system stability over time if connections are repeatedly aborted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.