CVE-2026-64470

Bluetooth: btusb: fix use-after-free on marvell probe failure

State: Published
Severity: Not scored
Published: Jul 25, 2026
Updated: Aug 17, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: fix use-after-free on marvell probe failure

Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion callback.

This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a4ccc9e33d2f01532bcceb621ea06bbf4db6efac to before 1edd524de5cc8143ece9c42c466346983dc5b5edAffected a4ccc9e33d2f01532bcceb621ea06bbf4db6efac to before 0ccb1cb0a464dab78284c34196cd3e8e18bab4c4Affected a4ccc9e33d2f01532bcceb621ea06bbf4db6efac to before 631de465aba7f8ae46478bf5f598111412e8eff8Affected a4ccc9e33d2f01532bcceb621ea06bbf4db6efac to before 6e1b10df890f4663cb38af9fc1c93d36747b75afAffected a4ccc9e33d2f01532bcceb621ea06bbf4db6efac to before 92c736866244340497a8a65afe2ac25354c2bf5eAffected a4ccc9e33d2f01532bcceb621ea06bbf4db6efac to before a7e941a395711791c7e98d9870c6562c2c9e9ef2Affected a4ccc9e33d2f01532bcceb621ea06bbf4db6efac to before 838c917a2f16eefe68def800ebf48a2af591149aAffected a4ccc9e33d2f01532bcceb621ea06bbf4db6efac to before c5b600a3c05b1a7a110d558df935a8fc8a471c79Affected
LinuxLinux	4.11Affected before 4.11Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

a4ccc9e33d2f01532bcceb621ea06bbf4db6efac to before 1edd524de5cc8143ece9c42c466346983dc5b5edAffected
a4ccc9e33d2f01532bcceb621ea06bbf4db6efac to before 0ccb1cb0a464dab78284c34196cd3e8e18bab4c4Affected
a4ccc9e33d2f01532bcceb621ea06bbf4db6efac to before 631de465aba7f8ae46478bf5f598111412e8eff8Affected
a4ccc9e33d2f01532bcceb621ea06bbf4db6efac to before 6e1b10df890f4663cb38af9fc1c93d36747b75afAffected
a4ccc9e33d2f01532bcceb621ea06bbf4db6efac to before 92c736866244340497a8a65afe2ac25354c2bf5eAffected
a4ccc9e33d2f01532bcceb621ea06bbf4db6efac to before a7e941a395711791c7e98d9870c6562c2c9e9ef2Affected
a4ccc9e33d2f01532bcceb621ea06bbf4db6efac to before 838c917a2f16eefe68def800ebf48a2af591149aAffected
a4ccc9e33d2f01532bcceb621ea06bbf4db6efac to before c5b600a3c05b1a7a110d558df935a8fc8a471c79Affected

LinuxLinux

4.11Affected
before 4.11Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.