What is the CVSS score of EUVD-2026-48952?

EUVD-2026-48952 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-48952?

The Linux kernel's Bluetooth BNEP subsystem contains a memory corruption vulnerability that adjacent attackers can exploit to crash systems or cause instability.. A patch is available.

How to fix or mitigate EUVD-2026-48952?

Within 24 hours, conduct inventory of all Linux systems with Bluetooth BNEP support and identify their current kernel versions. Within 7 days, obtain and apply the available vendor patch to all affected systems, beginning with production environments and critical infrastructure. Within 30 days, verify patch deployment across your entire Linux device fleet through automated compliance tools and archive evidence of system updates for audit purposes.

Linux Kernel EUVD-2026-48952

| CVE-2026-64408 HIGH

2026-07-25 Linux

GHSA-mgrm-7xvj-2jr3

Linux

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.3 MEDIUM

Adjacent Bluetooth vector is correct; AC:H reflects race condition timing requirement; realistic impact is kernel crash (DoS), not confidentiality or integrity compromise.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 16, 2026 - 09:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Jul 27, 2026 - 05:48 vuln.today

CVSS changed

Jul 27, 2026 - 05:22 NVD

8.8 (HIGH)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:50 cve.org

HIGH 8.8

CVE Published

Jul 25, 2026 - 08:50 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bnep: pin L2CAP connection during netdev registration

bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a freed parent device.

Take a reference to the L2CAP connection while holding the channel lock. Retain it until register_netdev() has taken the parent device reference.

AnalysisAI

Use-after-free race condition in the Linux kernel's Bluetooth BNEP subsystem allows an adjacent unauthenticated attacker to corrupt kernel memory or crash the system. During netdev registration via bnep_add_connection(), the L2CAP connection is read without holding the channel lock; if controller teardown occurs concurrently, the freed parent device is dereferenced by the network device registration path. The fix takes a reference to the L2CAP connection under the channel lock and retains it until register_netdev() secures its own parent device reference. No public exploit or CISA KEV listing has been identified at time of analysis, and the 0.22% EPSS score reflects low active exploitation probability.

Technical ContextAI

BNEP (Bluetooth Network Encapsulation Protocol) enables IP networking over Bluetooth links, commonly used in Bluetooth PAN and tethering profiles. It operates atop L2CAP (Logical Link Control and Adaptation Protocol), which manages segmentation and multiplexing over Bluetooth HCI devices. The vulnerable code path in bnep_add_connection() reads the l2cap_conn structure to extract the underlying HCI device and passes it as the parent to register_netdev(), but does so without holding the L2CAP channel lock. A concurrent controller teardown - such as a Bluetooth adapter reset or disconnection - can clear and kfree the l2cap_conn, leaving the netdev registration path to dereference stale memory. This is a CWE-362 (concurrent execution using shared resource with improper synchronization) leading to CWE-416 (use-after-free). CPE data confirms the affected codebase is the Linux kernel; the bug was introduced at commit 65f53e9802dbf and spans all maintained stable series prior to the fix commits.

RemediationAI

Upgrade to a patched kernel version: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc3 per the upstream stable commits linked at git.kernel.org. Ubuntu users should apply USN-8726-1 or USN-8727-1 as appropriate. As a compensating control where patching is not immediately feasible, disabling the BNEP kernel module (rmmod bnep, blacklisting via /etc/modprobe.d/blacklist.conf) eliminates the attack surface entirely but also disables Bluetooth PAN and tethering functionality. Alternatively, restricting Bluetooth adapter usage via rfkill or system policy limits exposure to the adjacent network vector. Note that unloading bnep may break legitimate Bluetooth networking on affected hosts, so weigh operational impact against exposure.

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-48952 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-48952

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code