CVE-2026-64178

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel Bluetooth BNEP

Publication date: 2026-07-19

Last updated on: 2026-08-12

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev->name bnep_add_connection() needs to keep holding the bnep_session_sem while reading dev->name (just like bnep_get_connlist() does); otherwise the bnep_session() thread can concurrently free the net_device, which can for example be triggered by a concurrent bnep_del_connection(). (This UAF is fairly uninteresting from a security perspective; calling bnep_add_connection() requires passing a capable(CAP_NET_ADMIN) check. It also requires completely tearing down a netdev during a fairly tight race window.)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-12

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64178

EUVD

EUVD-2026-45863

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 2.6.12.1 (inc) to 5.10.258 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.142 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's Bluetooth BNEP (Bluetooth Network Encapsulation Protocol) implementation. It occurs when bnep_add_connection() reads dev->name without holding the bnep_session_sem lock, allowing the bnep_session() thread to free the net_device concurrently during a race window. This could lead to a UAF condition when bnep_del_connection() is called simultaneously.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth BNEP module and requires kernel-level access to detect. No direct user-space commands are available for detection. Monitor kernel logs for Bluetooth-related crashes or use kernel debugging tools like ftrace or perf to observe race conditions in bnep_add_connection and bnep_del_connection.

Impact Analysis

The impact is limited due to requiring CAP_NET_ADMIN privileges to trigger. It could cause system instability or crashes if exploited during the narrow race window, but the security risk is considered low as it requires privileged access and a specific timing condition.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA. The issue involves a use-after-free read in the Linux kernel's Bluetooth BNEP module, which requires CAP_NET_ADMIN privileges to exploit. It does not involve data exposure or unauthorized access that would typically affect regulatory compliance.

Mitigation Strategies

Update the Linux kernel to the latest stable version where this vulnerability is patched. Since the vulnerability requires CAP_NET_ADMIN privileges to exploit, ensure proper access controls are in place. No additional mitigation steps are necessary beyond standard kernel updates.

Hi! I’m here to help you understand CVE-2026-64178. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70