SEPTEMBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-63948

UNKNOWN · CVSS N/A EPSS 0.21%

Source: NVD + CISA KEV + EPSS · Published 2026-07-19 · Last synced 2026-08-18

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's Bluetooth L2CAP implementation, specifically in the handling of channel references during timeout operations. An improper reference management can lead to a memory leak, potentially impacting system stability and resource utilization. Linux system administrators and developers working with Bluetooth functionalities should prioritize addressing this issue to ensure optimal performance and reliability.

CVE
CVE-2026-63948
Severity
UNKNOWN
CVSS
N/A
EPSS
0.21%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn __set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold() before scheduling the delayed work. The normal path in l2cap_chan_timeout() drops this reference with l2cap_chan_put() at the end, but the early return when chan->conn is NULL skips the put, leaking the reference. Add the missing l2cap_chan_put() before the early return.