[Bug 217581] New: Bluetooth L2CAP use-after-free

bugzilla-daemon
2023-06-21T10:19:38Z

Bug ID: 217581
Summary: Bluetooth L2CAP use-after-free
Product: Drivers
Version: 2.5
Hardware: All
OS: Linux
Status: NEW
Severity: high
Priority: P3
Component: Bluetooth
Assignee: linux-bluetooth@vger.kernel.org
Reporter: mohamed-yassine.jebabli@witbe.net
Regression: No

In reconnect slave mode, I start direct advertising. After establishing the
connection with the central device, we begin ATT exchanges over the L2CAP
socket, and then I receive a disconnect with L2CAP traces. This issue is
observed across different kernel versions such as 5.17, 6.2, 6.3, 6.3.7, etc.

Kernel log with bluetooth debugfs activated.