Skip to main content

Linux Kernel EUVDEUVD-2026-48777

| CVE-2026-64433 HIGH
Use After Free (CWE-416)
2026-07-25 Linux GHSA-g2v2-wh7x-5cmc
Privilege Escalation Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Gain low-priv local access
  2. Delivery
    Open Bluetooth MGMT socket (CAP_NET_ADMIN)
  3. Exploit
    Issue concurrent ADD_DEVICE and REMOVE_DEVICE for same address
  4. Install
    Race frees params in remove path
  5. C2
    add_device_complete dereferences freed params→flags
  6. Execute
    Achieve kernel heap UAF
  7. Impact
    Escalate to root

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires: (1) local access to the target system with the ability to open Bluetooth MGMT sockets - typically requiring CAP_NET_ADMIN or an equivalent capability granted by the system's privilege model; (2) the Bluetooth subsystem must be compiled in and active (Bluetooth adapter present or emulated, hci0 device available); (3) the vulnerable kernel version must be running (see affected version ranges); (4) a race condition must be won between the add_device_complete() callback and a concurrent MGMT_OP_REMOVE_DEVICE for the same Bluetooth address. The race window limits exploitation: repeated attempts are needed to hit the exact timing. Exploitation is bounded to the local system - no network vector exists. Containers and VMs with Bluetooth passthrough or virtual HCI adapters also expose this path if CAP_NET_ADMIN is available inside the container.
Impact

The vendor CVSS of 7.8 (AV:L/AC:L/PR:L) is slightly optimistic on the AC dimension - this is a race condition requiring concurrent Bluetooth MGMT operations (add_device racing remove_device), which realistically raises complexity toward AC:H. EPSS at 0.21% (11th percentile) indicates very low probability of observed exploitation, consistent with the complexity of triggering a kernel-level race condition. No KEV listing and no public PoC have been identified at time of analysis. The theoretical impact (C:H/I:H/A:H) reflects that kernel UAF vulnerabilities can be escalated to full privilege escalation, but practical exploitation requires controlled heap layout and precise timing. This is a genuine kernel quality/security fix but represents a lower operational priority than remotely exploitable kernel bugs - most likely to be leveraged by a local threat actor already on the system with low privileges and Bluetooth socket access (CAP_NET_ADMIN or equivalent).
Exploit ScenarioDerived

A local attacker with CAP_NET_ADMIN capability (or equivalent Bluetooth socket access) opens two concurrent Bluetooth MGMT sessions - one repeatedly issuing MGMT_OP_ADD_DEVICE and the other issuing MGMT_OP_REMOVE_DEVICE for the same device address. When the remove_device() path frees the hci_conn_params object while add_device_complete() is mid-execution and holds a stale pointer, reading params->flags accesses freed kernel heap memory. With careful heap spray techniques, an attacker could potentially redirect control flow or corrupt kernel data structures to escalate privileges to root.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 03, 2026

Use-after-free in the Linux kernel Bluetooth MGMT subsystem allows a local attacker with low privileges to trigger kernel memory corruption via a race condition between add_device and remove_device operations. The flaw exists in add_device_complete(), which dereferences a hci_conn_params pointer without holding hci_dev_lock, while a concurrent MGMT_OP_REMOVE_DEVICE path frees the same object under that lock. KASAN confirms exploitation as slab-use-after-free; no public exploit or active exploitation (CISA KEV) has been identified, and patches have been released across multiple stable branches.

RemediationAI

Upgrade to a patched kernel version: 6.6.145 or later for the 6.6.x LTS branch, 6.12.96 or later for the 6.12.x LTS branch, 6.15 or later for the 6.14.x branch, 7.1.4 or later, or any build including 7.2-rc3+. Patch commits are directly available from the Linux stable git tree (git.kernel.org links in references). The fix adds hci_dev_lock() to protect the hci_conn_params_lookup() call and the subsequent read of params->flags within add_device_complete(). For systems that cannot be patched immediately, a compensating control is to disable Bluetooth or restrict CAP_NET_ADMIN/CAP_NET_RAW capabilities for untrusted local users (e.g., via seccomp profiles, AppArmor, or SELinux policies), which prevents unprivileged users from issuing MGMT commands. Disabling Bluetooth kernel modules (blacklist btusb, bluetooth) eliminates the attack surface entirely but removes Bluetooth functionality.

Affected VersionsENISA

Linux 1e2e3044c1bc64a64aa0eaf7c17f7832c26c9775 <fa85d985f614bc3feb343000f14a1072e99b0df1
Linux 7e370545b8bdb54ed7f1ae485d6d24d3b62a0b53
Linux 1e2e3044c1bc64a64aa0eaf7c17f7832c26c9775 <b346efa825b5e4386f19bc63f81141652d496ec4
Linux 6.15
Linux patch: 7.2-rc3
Linux 31492b8386e5a243df26ca4a9421f6b041f414d5 <caed4a96d55757c139a899744657c032b6186665
Linux 6.12.30 <6.12.96
Linux 6.14.8 <6.15
Linux patch: 7.1.4
Linux 28826a89fdfd49f3291980c2e68b8a7c5d55e199 <e4369e4e970f3fa4676b76be14c1d315c87f22b6
Linux patch: 0
Linux patch: 6.12.96
Linux 6.6.92 <6.6.145
Linux patch: 6.18.39
Linux patch: 6.6.145
Linux 1e2e3044c1bc64a64aa0eaf7c17f7832c26c9775 <9531014c60c804e16099885d4a98aedcf31bce8d

Affected Packages

euvd linux fix: 6.6.145, 6.12.96, 6.15

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in net/bluetooth/mgmt.c within the Linux kernel's Bluetooth Management (MGMT) protocol stack. add_device_complete() executes in the hci_cmd_sync_work kworker context, holding only hci_req_sync_lock. It calls hci_conn_params_lookup(), which walks hdev->le_conn_params and is documented to require hdev->lock (hci_dev_lock). A concurrent call to remove_device() - which does hold hci_dev_lock - can invoke hci_conn_params_free(), calling list_del() and kfree() on the exact object returned by the lookup. When add_device_complete() subsequently reads params->flags, it dereferences freed heap memory (CWE-416, Use After Free). The root cause is a locking contract violation: the lookup result is used outside the critical section that protects the linked list, creating a classic TOCTOU race window. CPE data identifies the affected product as the Linux kernel itself across multiple stable release trains.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Race condition requires concurrent MGMT operations (AC:H); CAP_NET_ADMIN or Bluetooth socket access needed (PR:L); all CIA impacts plausible for kernel UAF leading to privilege escalation.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 03, 2026 - 18:37 NVD
7.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:51 nvd
HIGH 7.8
CVE Published
Jul 25, 2026 - 08:51 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete

add_device_complete() runs from the hci_cmd_sync_work kworker, which holds only hci_req_sync_lock and *not* hci_dev_lock. It calls hci_conn_params_lookup() and then dereferences the returned object (params->flags) without taking hci_dev_lock:

params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, le_addr_type(cp->addr.type)); ... device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, hdev->conn_flags, params ? params->flags : 0);

hci_conn_params_lookup() walks hdev->le_conn_params and is documented to require hdev->lock. A concurrent MGMT_OP_REMOVE_DEVICE (remove_device()), which does run under hci_dev_lock, can call hci_conn_params_free() to list_del() and kfree() the very object the lookup returned, so the subsequent params->flags read touches freed memory [0].

Hold hci_dev_lock() across the hci_conn_params_lookup() and the read of params->flags (and the matching event emission) so the lookup result cannot be freed by a concurrent remove_device() before it is used, honouring the locking contract of hci_conn_params_lookup().

[0]: (trailing page/memory-state dump trimmed) BUG: KASAN: slab-use-after-free in add_device_complete+0x358/0x3d8 net/bluetooth/mgmt.c:7671 Read of size 1 at addr ffff000017ab26c1 by task kworker/u9:8/388

CPU: 1 UID: 0 PID: 388 Comm: kworker/u9:8 Not tainted 7.0.11 #20 PREEMPT Hardware name: linux,dummy-virt (DT) Workqueue: hci0 hci_cmd_sync_work Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xb4/0xd4 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x118/0x5d8 mm/kasan/report.c:482 kasan_report+0xb0/0xf4 mm/kasan/report.c:595 __asan_report_load1_noabort+0x20/0x2c mm/kasan/report_generic.c:378 add_device_complete+0x358/0x3d8 net/bluetooth/mgmt.c:7671 hci_cmd_sync_work+0x14c/0x240 net/bluetooth/hci_sync.c:334 process_one_work+0x628/0xd38 kernel/workqueue.c:3289 process_scheduled_works kernel/workqueue.c:3372 [inline] worker_thread+0x7a8/0xac0 kernel/workqueue.c:3453 kthread+0x39c/0x444 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860

Allocated by task 3401: kasan_save_stack+0x3c/0x64 mm/kasan/common.c:57 kasan_save_track+0x20/0x3c mm/kasan/common.c:78 kasan_save_alloc_info+0x40/0x54 mm/kasan/generic.c:570 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xd4/0xd8 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x1b0/0x458 mm/slub.c:5385 kmalloc_noprof include/linux/slab.h:950 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] hci_conn_params_add+0x10c/0x4b0 net/bluetooth/hci_core.c:2279 hci_conn_params_set net/bluetooth/mgmt.c:5162 [inline] add_device+0x5b4/0xa54 net/bluetooth/mgmt.c:7755 hci_mgmt_cmd net/bluetooth/hci_sock.c:1721 [inline] hci_sock_sendmsg+0x10b4/0x1dd0 net/bluetooth/hci_sock.c:1841 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0xe0/0x128 net/socket.c:742 sock_write_iter+0x250/0x390 net/socket.c:1195 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x66c/0xab0 fs/read_write.c:688 ksys_write+0x1fc/0x24c fs/read_write.c:740 __do_sys_write fs/read_write.c:751 [inline] __se_sys_write fs/read_write.c:748 [inline] __arm64_sys_write+0x70/0xa4 fs/read_write.c:748 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x84/0x2a8 arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0xe4/0x294 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x44/0x5c arch/arm64/kernel/syscall.c:151 el0_svc+0x38/0xac arch/arm64/kernel/entry-common.c:724 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:743 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596

Freed by task 3740: kasan_save_stack+0x3c/0x64 ---truncated---

Executive ViewAI

Why It Matters

A use-after-free vulnerability in Linux kernel Bluetooth (CVE-2026-64433, CVSS 7.8) allows local users to crash systems or escalate privileges through kernel memory corruption. No public exploit identified at time of analysis; however, patches are available and should be prioritized across all Linux systems with Bluetooth enabled.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 89% exploitable
Prevalence
Ubiquitous
Linux kernel runs the majority of servers, containers, and embedded systems globally
Data Quality
4 sources
Confidence: Medium
EUVD 🇯🇵JVN NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64433 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/383231 REF https://git.kernel.org/stable/c/9531014c60c804e16099885d4a98aedcf31bce8d REF https://git.kernel.org/stable/c/b346efa825b5e4386f19bc63f81141652d496ec4 REF https://git.kernel.org/stable/c/caed4a96d55757c139a899744657c032b6186665 REF https://git.kernel.org/stable/c/e4369e4e970f3fa4676b76be14c1d315c87f22b6 REF https://git.kernel.org/stable/c/fa85d985f614bc3feb343000f14a1072e99b0df1

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy