CVE-2026-64178
Received Received - Intake

Use-After-Free in Linux Kernel Bluetooth BNEP

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev->name bnep_add_connection() needs to keep holding the bnep_session_sem while reading dev->name (just like bnep_get_connlist() does); otherwise the bnep_session() thread can concurrently free the net_device, which can for example be triggered by a concurrent bnep_del_connection(). (This UAF is fairly uninteresting from a security perspective; calling bnep_add_connection() requires passing a capable(CAP_NET_ADMIN) check. It also requires completely tearing down a netdev during a fairly tight race window.)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64178
EUVD
EUVD-2026-45863

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's Bluetooth BNEP (Bluetooth Network Encapsulation Protocol) implementation. It occurs when bnep_add_connection() reads dev->name without holding the bnep_session_sem lock, allowing the bnep_session() thread to free the net_device concurrently during a race window. This could lead to a UAF condition when bnep_del_connection() is called simultaneously.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth BNEP module and requires kernel-level access to detect. No direct user-space commands are available for detection. Monitor kernel logs for Bluetooth-related crashes or use kernel debugging tools like ftrace or perf to observe race conditions in bnep_add_connection and bnep_del_connection.

Impact Analysis

The impact is limited due to requiring CAP_NET_ADMIN privileges to trigger. It could cause system instability or crashes if exploited during the narrow race window, but the security risk is considered low as it requires privileged access and a specific timing condition.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA. The issue involves a use-after-free read in the Linux kernel's Bluetooth BNEP module, which requires CAP_NET_ADMIN privileges to exploit. It does not involve data exposure or unauthorized access that would typically affect regulatory compliance.

Mitigation Strategies

Update the Linux kernel to the latest stable version where this vulnerability is patched. Since the vulnerability requires CAP_NET_ADMIN privileges to exploit, ensure proper access controls are in place. No additional mitigation steps are necessary beyond standard kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64178. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart