Re: [PATCH] Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Thu, 23 Jul 2026 14:48:45 +0800 you wrote:
> l2cap_le_connect_rsp() obtains a channel via
> __l2cap_get_chan_by_ident() but neither holds a reference nor uses
> l2cap_chan_hold_unless_zero() before locking and operating on it.
> A concurrent l2cap_chan_del() triggered by a remote disconnect can
> free the channel between the lookup and l2cap_chan_lock(), causing
> a use-after-free.
> 
> [...]

Here is the summary with links:
  - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
    https://git.kernel.org/bluetooth/bluetooth-next/c/5de0af8b2ace

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html