In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

__set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold()
before scheduling the delayed work. The normal path in
l2cap_chan_timeout() drops this reference with l2cap_chan_put() at the
end, but the early return when chan->conn is NULL skips the put,
leaking the reference.

Add the missing l2cap_chan_put() before the early return.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0021.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
06acb75e7ed600d0bbf7bff5628aa8f24a97978c affected < 50f1bcaaaa3a80bb1c3472044bc146e8d49d51ee
e97e16433eb4533083b096a3824b93a5ca3aee79 affected < b5c59a5b469e2a809a2d57eda4ded94235971060
8960ff650aec70485b40771cd8e6e8c4cb467d33 affected < 8894c2010435a56ce7c6c2a8785860c13554df2f
955b5b6c54d95b5e7444dfc81c95c8e013f27ac0 affected < 63cd225cc13d782a85e2a73c04d0d350153eada1
adf0398cee86643b8eacde95f17d073d022f782c affected < 107c826e4ef9ec5ad8f60e6fe64d8d5325ba508f
adf0398cee86643b8eacde95f17d073d022f782c affected < e8a5baff5be273ca07771fd2b9bb1f2a4152917b
adf0398cee86643b8eacde95f17d073d022f782c affected < 08d81fe96f80a8e20c7acb573b6a45d901fcf2cd
adf0398cee86643b8eacde95f17d073d022f782c affected < 9dbd84990394c51f5cee1e8871bb5ff8af5ed939
e137e2ba96e51902dc2878131823a96bf8e638ae affected —
6466ee65e5b27161c846c73ef407f49dfa1bd1d9 affected —
eb86f955488c39526534211f2610e48a5cf8ead4 affected —
5.10.217 affected < 5.10.259
5.15.159 affected < 5.15.210
6.1.91 affected < 6.1.176
6.6.31 affected < 6.6.143
4.19.314 affected < 4.20
5.4.276 affected < 5.5
6.8.10 affected < 6.9
Linux Linux affected
Version Status Constraints
6.9 affected —
0 unaffected < 6.9
5.10.259 unaffected ≤ 5.10.*
5.15.210 unaffected ≤ 5.15.*
6.1.176 unaffected ≤ 6.1.*
6.6.143 unaffected ≤ 6.6.*
6.12.93 unaffected ≤ 6.12.*
6.18.35 unaffected ≤ 6.18.*
7.0.12 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8593-1 Linux kernel vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/08d81fe96f80a8e20c7acb573b6a45d901fcf2cd cve-icon
https://git.kernel.org/stable/c/107c826e4ef9ec5ad8f60e6fe64d8d5325ba508f cve-icon
https://git.kernel.org/stable/c/50f1bcaaaa3a80bb1c3472044bc146e8d49d51ee cve-icon
https://git.kernel.org/stable/c/63cd225cc13d782a85e2a73c04d0d350153eada1 cve-icon
https://git.kernel.org/stable/c/8894c2010435a56ce7c6c2a8785860c13554df2f cve-icon
https://git.kernel.org/stable/c/9dbd84990394c51f5cee1e8871bb5ff8af5ed939 cve-icon
https://git.kernel.org/stable/c/b5c59a5b469e2a809a2d57eda4ded94235971060 cve-icon
https://git.kernel.org/stable/c/e8a5baff5be273ca07771fd2b9bb1f2a4152917b cve-icon
https://lore.kernel.org/linux-cve-announce/2026071954-CVE-2026-63948-8f4d@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-63948 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-63948 cve-icon
History

Wed, 22 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-911
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sun, 19 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn __set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold() before scheduling the delayed work. The normal path in l2cap_chan_timeout() drops this reference with l2cap_chan_put() at the end, but the early return when chan->conn is NULL skips the put, leaking the reference. Add the missing l2cap_chan_put() before the early return.
Title Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-19T14:55:41.985Z

Reserved: 2026-07-19T07:54:57.023Z

Link: CVE-2026-63948

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63948 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-24T05:30:05Z

Weaknesses