An issue was discovered in l2capsockrelease in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled.
{ "urgency": "not yet assigned" }