This CVE patches a use-after-free in the Linux kernel's L2CAP Bluetooth socket layer that stems from a fundamental mismatch between how the API expected callback lifetimes to work and how the kernel's locking actually behaves. When l2cap_sock_new_connection_cb() creates and returns a child channel, it runs after release_sock() has already dropped the parent lock — but the child socket has simultaneously been exposed to concurrent accept() calls from other tasks. The callback believes it's returning a freshly allocated channel; the kernel sees a reference that may already be dangling. No amount of careful coding inside the callback fixes this, because the race is baked into the API contract itself.

The fix restructures the ownership model: the core now allocates and links the child channel before invoking the callback, reducing the callback to a configure-and-return-error pattern. This eliminates the impossible requirement that callbacks manage lifetimes across unsynchronized windows. The consolidation of initialization into l2cap_chan_set_defaults() reduces duplicated code that could drift out of sync — but it also concentrates initialization logic that previously had blast-radius containment. A defect in set_defaults now propagates to all accepted sockets simultaneously, shifting the failure mode topology from per-connection UAF to potential systemic misconfiguration.

For defenders: verify your kernel version includes the fix (check for l2cap_chan_set_defaults() changes in net/bluetooth/l2cap_sock.c), and audit any custom Bluetooth channel handlers for similar callback-allocates-resource patterns. The deeper action is recognizing that callback-based child-resource instantiation across unsynchronized boundaries is a recurring pattern in kernel networking — AF_INET accept paths and USB descriptor retrieval have shown structurally similar issues. When reviewing similar interfaces, the contract should be: core owns the resource, callback only configures and returns error codes. Anything that allocates and returns a reference back to core after lock release is the vulnerability pattern itself.