Re: [PATCH] Bluetooth: fix UAF in bt_accept_dequeue()

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Sun, 28 Jun 2026 02:23:05 +0200 you wrote:
> bt_accept_get() takes a temporary reference before dropping the accept
> queue lock. bt_accept_dequeue() currently drops that reference before
> bt_accept_unlink(), leaving only the queue reference.
> 
> bt_accept_unlink() drops the queue reference. The subsequent
> sock_hold() therefore accesses freed memory if it was the final
> reference, as observed by KASAN during listening L2CAP socket cleanup.
> 
> [...]

Here is the summary with links:
  - Bluetooth: fix UAF in bt_accept_dequeue()
    https://git.kernel.org/bluetooth/bluetooth-next/c/a8c481ee3819

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html