CVE-2026-64144
Received Received - Intake

Bluetooth: btmtk USB Control URB Setup Packet Leak

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix urb->setup_packet leak in error paths The setup_packet of control urb is not freed if usb_submit_urb fails or the submitted urb is killed. Add free in these two paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64144
EUVD
EUVD-2026-45829

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory leak vulnerability in the Linux kernel's Bluetooth MediaTek driver. When a USB control urb fails to submit or is killed, the setup_packet memory is not freed, potentially causing resource exhaustion.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem (btmtk driver) and involves a memory leak in USB control URBs. Detection requires checking kernel logs for Bluetooth-related errors or memory leaks. Use commands like dmesg | grep -i bluetooth or journalctl -k | grep -i bluetooth to inspect logs for errors related to urb setup_packet leaks.

Impact Analysis

The impact is limited to systems using the Linux kernel with Bluetooth MediaTek hardware. It may cause memory leaks leading to system instability or crashes if exploited repeatedly.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level Bluetooth driver issue in the Linux kernel. Compliance risks would only arise if exploitation led to unauthorized data access or system compromise, which is not indicated in the provided context.

Mitigation Strategies

Apply the latest kernel update that includes the fix for CVE-2026-64144. If immediate patching is not possible, disable the btmtk Bluetooth driver if not in use by blacklisting the module (echo blacklist btmtk >> /etc/modprobe.d/disable-btmtk.conf) and reboot.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64144. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart