CVE-2026-64178 Details
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev->name bnep_add_connection() needs to keep holding the bnep_session_sem while reading dev->name (just like bnep_get_connlist() does); otherwise the bnep_session() thread can concurrently free the net_device, which can for example be triggered by a concurrent bnep_del_connection(). (This UAF is fairly uninteresting from a security perspective; calling bnep_add_connection() requires passing a capable(CAP_NET_ADMIN) check. It also requires completely tearing down a netdev during a fairly tight race window.)
A use-after-free vulnerability has been addressed in the Linux kernel's Bluetooth BNEP (Bluetooth Network Encapsulation Protocol) implementation. The issue arises in the 'bnep_add_connection()' function, which failed to properly synchronize access to the 'dev->name' property of a network device. This oversight allowed a concurrent thread, handling the removal of a BNEP connection, to free the network device while it was still being accessed, leading to a potential use-after-free scenario. Although this vulnerability is not considered highly security-sensitive—since adding a BNEP connection requires administrative privileges and involves dismantling a network device during a brief, vulnerable period— it could still be exploited under specific conditions.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/4907596f25b1720fa948371ac5f6c1f8da10a5bc | kernel.org | Patch |
| https://git.kernel.org/stable/c/5506aec795135cdd4cbf4e845929155663b25055 | kernel.org | Patch |
| https://git.kernel.org/stable/c/59e932ded949fa6f0340bf7c6d7818f962fa4fd2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/915a92182e2cda9cd7d2479020a44c6eda986f7c | kernel.org | Patch |
| https://git.kernel.org/stable/c/a75bbcb10cb21acc169b785e9804f57d97873a9c | kernel.org | Patch |
| https://git.kernel.org/stable/c/b21805258d7e926adfd455fc820a447b90da3b82 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e7578529b97e5d4e439cf8f3e637c2303015338f | kernel.org | Patch |
| https://git.kernel.org/stable/c/fe69f634b076ae3ca81c5a5b845d9bba527036f7 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.12.1, < 5.10.258 >= 5.11, < 5.15.209 >= 5.16, < 6.1.175 >= 6.2, < 6.6.142 >= 6.7, < 6.12.92 >= 6.13, < 6.18.34 >= 6.19, < 7.0.11 2.6.12 - 2.6.12 rc2 2.6.12 rc3 2.6.12 rc4 2.6.12 rc5 7.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 12, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | kernel.org |
| Jul 19, 2026 | New CVE Received | kernel.org |