CVE-2026-63948

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A reference leak occurs in the L2CAP Bluetooth subsystem within the l2cap chan timeout() function. The set chan timer() function acquires a reference to the channel using l2cap chan hold() before scheduling delayed work. While the standard execution path releases this reference via l2cap chan put(), an early return triggered when the conn variable is NULL bypasses this release, resulting in a reference leak.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.