CVE Explorer

CVE-2026-63948

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn __set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold() before scheduling the delayed work. The normal path in l2cap_chan_timeout() drops this reference with l2cap_chan_put() at the end, but the early return when chan->conn is NULL skips the put, leaking the reference. Add the missing l2cap_chan_put() before the early return.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:0ce8d5bae8a26fe8a55284415d89f2f550d19286618d5ec48d22679767d63a19

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"50f1bcaaaa3a80bb1c3472044bc146e8d49d51ee","status":"affected","version":"06acb75e7ed600d0bbf7bff5628aa8f24a97978c","versionType":"git"},{"lessThan":"b5c59a5b469e2a809a2d57eda4ded94235971060","status":"affected","version":"e97e16433eb4533083b096a3824b93a5ca3aee79","versionType":"git"},{"lessThan":"8894c2010435a56ce7c6c2a8785860c13554df2f","status":"affected","version":"8960ff650aec70485b4…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:d0a5b02fe6297ab3bc7c19f89ee25d187d48917489c5e9a4526c35ad20b6bcca · sha256:0e20195eeb7f33c8… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"less…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:d0a5b02fe6297ab3bc7c19f89ee25d187d48917489c5e9a4526c35ad20b6bcca · sha256:0e20195eeb7f33c8… · /containers/cna/affected/1

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:d0a5b02fe6297ab3bc7c19f89ee25d187d48917489c5e9a4526c35ad20b6bcca · sha256:0e20195eeb7f33c8… · /containers/cna/affected/0

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:d0a5b02fe6297ab3bc7c19f89ee25d187d48917489c5e9a4526c35ad20b6bcca · sha256:0e20195eeb7f33c8… · /containers/cna/affected/1

Source references

8 source assertions

{"url":"https://git.kernel.org/stable/c/08d81fe96f80a8e20c7acb573b6a45d901fcf2cd"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:d0a5b02fe6297ab3bc7c19f89ee25d187d48917489c5e9a4526c35ad20b6bcca · sha256:0e20195eeb7f33c8… · /containers/cna/references/6

{"url":"https://git.kernel.org/stable/c/107c826e4ef9ec5ad8f60e6fe64d8d5325ba508f"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:d0a5b02fe6297ab3bc7c19f89ee25d187d48917489c5e9a4526c35ad20b6bcca · sha256:0e20195eeb7f33c8… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/50f1bcaaaa3a80bb1c3472044bc146e8d49d51ee"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:d0a5b02fe6297ab3bc7c19f89ee25d187d48917489c5e9a4526c35ad20b6bcca · sha256:0e20195eeb7f33c8… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/63cd225cc13d782a85e2a73c04d0d350153eada1"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:d0a5b02fe6297ab3bc7c19f89ee25d187d48917489c5e9a4526c35ad20b6bcca · sha256:0e20195eeb7f33c8… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/8894c2010435a56ce7c6c2a8785860c13554df2f"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:d0a5b02fe6297ab3bc7c19f89ee25d187d48917489c5e9a4526c35ad20b6bcca · sha256:0e20195eeb7f33c8… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/9dbd84990394c51f5cee1e8871bb5ff8af5ed939"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:d0a5b02fe6297ab3bc7c19f89ee25d187d48917489c5e9a4526c35ad20b6bcca · sha256:0e20195eeb7f33c8… · /containers/cna/references/7

{"url":"https://git.kernel.org/stable/c/b5c59a5b469e2a809a2d57eda4ded94235971060"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:d0a5b02fe6297ab3bc7c19f89ee25d187d48917489c5e9a4526c35ad20b6bcca · sha256:0e20195eeb7f33c8… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/e8a5baff5be273ca07771fd2b9bb1f2a4152917b"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:d0a5b02fe6297ab3bc7c19f89ee25d187d48917489c5e9a4526c35ad20b6bcca · sha256:0e20195eeb7f33c8… · /containers/cna/references/5

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer