What is the CVSS score of CVE-2026-64144?

CVE-2026-64144 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64144?

Yes, a patch is available for CVE-2026-64144. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64144

EUVD-2026-45829 MEDIUM

Memory Leak (CWE-401)

2026-07-19 Linux

GHSA-wh4m-6pmv-mq2m

Information Disclosure Linux Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local access and low privileges needed to trigger USB driver error paths; no confidentiality or integrity impact, only availability via incremental memory exhaustion.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

4.7 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 22:01 vuln.today

CVSS changed

Aug 17, 2026 - 19:52 NVD

5.5 (MEDIUM)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 nvd

MEDIUM 5.5

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btmtk: fix urb->setup_packet leak in error paths

The setup_packet of control urb is not freed if usb_submit_urb fails or the submitted urb is killed. Add free in these two paths.

AnalysisAI

Memory leak in the Linux kernel's btmtk (MediaTek Bluetooth USB) driver allows a local low-privileged user to exhaust kernel memory, causing denial of service. The vulnerability affects systems running Linux kernel from commit a1c49c434e15050b5dafe3b6f5cc732d4f02d657 onward, with patches confirmed in stable releases 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and no active exploitation has been confirmed; an EPSS of 0.18% at the 7th percentile places this firmly in low-priority territory for most organizations.

Technical ContextAI

The btmtk driver manages MediaTek-chipset Bluetooth devices over USB. USB control transfers attach a setup_packet-a small allocation describing the control request header-to a USB Request Block (URB) before submission. CWE-401 (Missing Release of Memory after Effective Lifetime) applies because the btmtk driver's error-handling paths omit the corresponding kfree of urb->setup_packet in two distinct cases: when usb_submit_urb() returns a failure code and when an already-submitted URB is subsequently killed via usb_kill_urb(). The fix adds explicit frees in both paths. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* starting from the introducing commit, scoped to the USB control transfer path within the Bluetooth subsystem rather than the broader USB or Bluetooth stacks. The 'Information Disclosure' tag present in source data is inconsistent with CWE-401 and the CVSS C:N metric; no confidentiality impact is substantiated.

RemediationAI

Upgrade to a patched Linux kernel version: 6.6.142 or later for the 6.6 LTS series, 6.12.92 or later for the 6.12 LTS series, 6.18.34 or later for the 6.18 series, 7.0.11 or later for the 7.0 series, or 7.1 for mainline. Fix commits are available at https://git.kernel.org/stable/c/2a1905730e0c771b999906a7b509722f795563c6 and the four sibling stable commits referenced in the CVE. Ubuntu users should apply the packages covered by USN-8593-1 at https://ubuntu.com/security/notices/USN-8593-1. If immediate patching is not feasible and MediaTek Bluetooth USB functionality is not required, blacklisting the btmtk_usb kernel module (adding 'blacklist btmtk_usb' to /etc/modprobe.d/blacklist.conf and running modprobe -r btmtk_usb) eliminates the vulnerable code path entirely at the cost of disabling all MediaTek Bluetooth USB adapters on that host. No other compensating control meaningfully addresses a kernel-level memory leak once the module is loaded.

Same weakness CWE-401 – Memory Leak

View all

CVE-2020-13934 HIGH

7.5

CVE-2016-4232 HIGH POC

7.5

CVE-2024-25450 HIGH POC

8.8

CVE-2023-33718 HIGH POC

8.8

CVE-2019-6128 HIGH POC

8.8

CVE-2026-67183 HIGH POC

8.7

CVE-2023-34451 HIGH POC

8.2

CVE-2023-41484 HIGH POC

8.1

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64144 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64144

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-401 – Memory Leak

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code