Linux Kernel CVE-2026-64557

The flaw is in the kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) socket layer, which multiplexes higher-layer Bluetooth protocols over ACL links. On an inbound L2CAP connection the core invokes ->new_connection() to create a child channel/socket tied to the parent listening socket. In the buggy code, l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after calling release_sock(parent); dropping the parent lock made the newly enqueued child socket reachable through the accept queue, so a concurrent accept()+close() could free the socket before the callback dereferenced it - a classic use-after-free (functionally CWE-416, though the input lists CWE as N/A). The fix inverts ownership: l2cap_new_connection() allocates the child channel and links it into the conn list via __l2cap_chan_add() before invoking the callback, so the conn-list reference keeps it alive; the callback now receives a pre-allocated new_chan and returns an errno. Duplicated channel configuration was consolidated into l2cap_chan_set_defaults(), which inherits from the parent channel. CPE data identifies the component only generically as cpe:2.3:a:linux:linux.