What is the CVSS score of CVE-2026-64178?

CVE-2026-64178 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64178?

The Linux kernel Bluetooth BNEP subsystem contains a use-after-free vulnerability affecting multiple recent kernel versions; however, exploitation requires local administrative privileges and no…. A patch is available.

How to fix or mitigate CVE-2026-64178?

Within 24 hours, identify systems running Linux kernel versions 2.6.12 through 7.x prior to vendor-released fixes (including 6.12.92, 6.6.142, 6.1.175, 5.15.209, 5.10.258, 6.18.34, 7.0.11, 7.1). Within 7 days, schedule kernel upgrades to patched versions during regular maintenance windows. Within 30 days, complete kernel updates across all identified systems through standard change management.

Linux Kernel CVE-2026-64178

EUVD-2026-45863 HIGH

Use After Free (CWE-416)

2026-07-19 Linux

GHSA-8h46-ffj6-v52h

Information Disclosure Linux Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

3.0 LOW

Requires local CAP_NET_ADMIN (PR:H) and winning a tight teardown race (AC:H); impact is a UAF read causing limited info leak (C:L) or possible instability (A:L), no integrity impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:49 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.8 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:41 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:41 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bnep: Fix UAF read of dev->name

bnep_add_connection() needs to keep holding the bnep_session_sem while reading dev->name (just like bnep_get_connlist() does); otherwise the bnep_session() thread can concurrently free the net_device, which can for example be triggered by a concurrent bnep_del_connection().

(This UAF is fairly uninteresting from a security perspective; calling bnep_add_connection() requires passing a capable(CAP_NET_ADMIN) check. It also requires completely tearing down a netdev during a fairly tight race window.)

AnalysisAI

Use-after-free read in the Linux kernel Bluetooth BNEP subsystem allows a local privileged user (CAP_NET_ADMIN) to read freed net_device memory by winning a race against concurrent teardown. Affected kernels span from 2.6.12 through the 6.x/7.x stable series until the fixed releases (e.g. 6.12.92, 6.6.142, 6.1.175, 5.15.209, 5.10.258, 6.18.34, 7.0.11, 7.1). The upstream maintainers explicitly characterize this as low practical security interest; there is no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile).

Technical ContextAI

The flaw is in bnep_add_connection() within the kernel's Bluetooth Network Encapsulation Protocol (BNEP) module (net/bluetooth/bnep), which layers Ethernet-style networking over an L2CAP Bluetooth link by registering a net_device. The function reads dev->name without holding bnep_session_sem, unlike bnep_get_connlist(), so the bnep_session() kernel thread can concurrently free the underlying net_device (for example via bnep_del_connection()), producing a read of freed memory. The root-cause class is a use-after-free (CWE-416, though the input lists CWE as N/A) stemming from missing lock coverage over a shared object during a tight teardown race. The CPE data identifies the affected product only generically as cpe:2.3:a:linux:linux, with EUVD enumerating the vulnerable git commit ranges rather than a single version boundary.

RemediationAI

Vendor-released patch: update to a fixed stable kernel for your branch - 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1 (or later), applying the commit that restores holding bnep_session_sem while reading dev->name (see https://git.kernel.org/stable/c/5506aec795135cdd4cbf4e845929155663b25055 and companion commits). Where immediate patching is not possible, the most effective compensating control is to prevent loading/use of the BNEP module: blacklist the bnep kernel module (e.g. via modprobe blacklist) if Bluetooth PAN/tethering is not required, which eliminates the attack surface entirely at the cost of disabling Bluetooth network tethering. Additionally, restrict CAP_NET_ADMIN to trusted administrators only, since exploitation requires that capability; this limits who can invoke the vulnerable path but does not fix the race for legitimately privileged users. Track fix status via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-64178.

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64178 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64178

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-416 – Use After Free

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code