Linux Kernel CVE-2026-64406

The flaw resides in the Linux kernel's Bluetooth subsystem (net/bluetooth/af_bluetooth.c), specifically in the L2CAP accept-queue management pair bt_accept_get() / bt_accept_dequeue(). bt_accept_get() acquires a temporary 'queue-walk' reference on the socket before releasing the accept-queue lock, preventing races during traversal. In the buggy implementation, bt_accept_dequeue() prematurely calls sock_put() to drop this temporary reference before calling bt_accept_unlink(), which itself drops the accept-queue's reference. When the temporary reference was the last one, the kernel slab allocator reclaims the socket object; the sock_hold() call that follows accesses freed memory, constituting CWE-416 (Use After Free). KASAN (Kernel Address Sanitizer) detects this as a slab-use-after-free during listening L2CAP socket cleanup. The fix retains the temporary reference across the unlink call and transfers it to the caller on the success path, dropping it explicitly only on closed or not-yet-connected paths. Affected CPEs: cpe:2.3:a:linux:linux across multiple stable branches.