CVE-2026-64408

A flaw was found in the Bluetooth Network Encapsulation Protocol (BNEP) module of the Linux kernel. The bnep_add_connection() function reads the Logical Link Control and Adaptation Protocol (L2CAP) connection without properly holding a channel lock. This can allow a local attacker to trigger a use-after-free vulnerability during network device registration, potentially leading to a system crash and denial of service.

Bluetooth BNEP netdev registration can race with L2CAP connection teardown because bnep_add_connection used the channel connection without holding a lock or taking a reference. If controller teardown clears and releases the L2CAP connection while register_netdev() is using the HCI parent device, the registration path can dereference a freed parent device. This is a race condition and use-after-free candidate, so impact is at least denial of service via kernel crash and in worst case may allow limited confidentiality or integrity impact from memory corruption. For the CVSS the PR:N is used in the paranoid score because a Bluetooth adjacent peer may be able to influence connection setup and teardown through the BNEP/L2CAP protocol while the vulnerable host performs netdev registration. The issue is not Internet reachable, but it may be reachable from Bluetooth radio range or from a local process that can create BNEP connections.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.