Riskcovery

CVE-2026-64471

Bluetooth: btusb: fix use-after-free on registration failure

State
Published
Severity
Not scored
Published
Jul 25, 2026
Updated
Aug 17, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: fix use-after-free on registration failure

Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected.

This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 9bfa35fe422c74882e27cc54450a5f76c96aad68 to before e09ac7d0c6859a360bf36e7104aef03f88184e0bAffected
  • 9bfa35fe422c74882e27cc54450a5f76c96aad68 to before 468fcdfaeb937163dd250773a9fed17ab1fa203cAffected
  • 9bfa35fe422c74882e27cc54450a5f76c96aad68 to before 1ce5012944afaddbda939ec6bae9800fce84abbcAffected
  • 9bfa35fe422c74882e27cc54450a5f76c96aad68 to before e6313b800da61a26c2fdd5eba0105e197c0ab3bcAffected
  • 9bfa35fe422c74882e27cc54450a5f76c96aad68 to before 14e02f1449ba425a44dedbec9a21efafb056e09fAffected
  • 9bfa35fe422c74882e27cc54450a5f76c96aad68 to before 8db0ce3de78367f61c2970c0f16d9adee8830a23Affected
  • 9bfa35fe422c74882e27cc54450a5f76c96aad68 to before da7d7758fe884b256ddc9fef562e5ddef7952383Affected
  • 9bfa35fe422c74882e27cc54450a5f76c96aad68 to before eedc6867ebad73edbfaf9a0a65fbef7115cc4753Affected
LinuxLinux
  • 2.6.27Affected
  • before 2.6.27Not affected
  • 5.10.261 through 5.10.*Not affected
  • 5.15.212 through 5.15.*Not affected
  • 6.1.178 through 6.1.*Not affected
  • 6.6.145 through 6.6.*Not affected
  • 6.12.96 through 6.12.*Not affected
  • 6.18.39 through 6.18.*Not affected
  • 7.1.4 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.