CVE-2026-74540

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Bluetooth L2CAP implementation. The function l2cap le connect rsp() retrieves a channel using l2cap get chan by ident() but fails to hold a reference or use l2cap chan hold unless zero() before locking and operating on it. If a remote disconnect triggers a concurrent l2cap chan del(), the channel can be freed between the lookup and l2cap chan lock(), leading to a use-after-free condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.