In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after release_sock(parent). Once the parent lock is dropped the newly enqueued child socket sk is reachable via the accept queue, so another task can accept and free it before the callback dereferences sk, resulting in a use-after-free. Rework the ->new_connection() op so the core, rather than the callback, owns the child channel's lifetime. The op now receives a pre-allocated new_chan and returns an errno instead of allocating and returning a channel. l2cap_new_connection() allocates the child channel and links it into the conn list via __l2cap_chan_add() before invoking the callback, so the conn-list reference keeps the channel alive once release_sock(parent) exposes the socket to other tasks. Channel configuration that was duplicated in l2cap_sock_init() and the various new_connection
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-64557 is a use-after-free vulnerability in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) implementation, specifically in the l2cap_sock_new_connection_cb() function. The flaw arises from a race condition where a parent socket's lock is released before a callback completes dereferencing a newly created child socket. Once the parent lock is dropped, the child socket becomes accessible through the accept queue to other tasks, which can accept and free it before the callback attempts to use it—resulting in a use-after-free condition. This vulnerability affects Linux systems with Bluetooth functionality enabled and poses a risk to both local privilege escalation and denial of service scenarios, making it relevant to desktop, laptop, and embedded Linux deployments.
While CVE-2026-64557 does not currently map to specific MITRE ATT&CK techniques or have documented Casky skill matches, practitioners using Casky.ai's Claude-powered analysis would leverage extended reasoning to identify the underlying attack vectors: detection would focus on memory safety violations (T1499 - Endpoint Denial of Service), abnormal kernel behavior patterns, and socket state anomalies. Security teams would examine kernel logs for unexpected socket cleanup events, race condition indicators in Bluetooth subsystem operations, and processes attempting to interact with freed memory structures. Casky's skill mapping would help practitioners correlate this vulnerability with defensive techniques around kernel hardening, memory protection mechanisms (ASLR, DEP), and Bluetooth driver isolation, enabling proactive threat hunting for exploitation attempts targeting the L2CAP connection establishment workflow.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-64557. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation