CVE-2026-64178 - Vulnerability Details

- Bluetooth: bnep: Fix UAF read of dev->name

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bnep: Fix UAF read of dev->name

bnep_add_connection() needs to keep holding the bnep_session_sem while
reading dev->name (just like bnep_get_connlist() does); otherwise the
bnep_session() thread can concurrently free the net_device, which can for
example be triggered by a concurrent bnep_del_connection().

(This UAF is fairly uninteresting from a security perspective;
calling bnep_add_connection() requires passing a capable(CAP_NET_ADMIN)
check. It also requires completely tearing down a netdev during a fairly
tight race window.)

Published: 2026-07-19

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a use‑after‑free read in the Linux kernel’s Bluetooth BNEP subsystem. When bnep_add_connection releases the session semaphore before reading dev->name, a concurrent bnep_del_connection can free the net_device, causing the stale memory read to expose the device name. The function requires CAP_NET_ADMIN privileges and the race window is narrow, so the practical effect is limited to information disclosure by privileged users.

Affected Systems

Any Linux kernel build that includes the Bluetooth BNEP module may be vulnerable; the specific kernel versions affected are not listed in the data provided. Administrators should verify whether their kernel contains this subsystem and its current version.

Risk and Exploitability

The CVSS base score of 8.8 indicates a high severity flaw. The EPSS probability is reported as less than 1 %, implying a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user with CAP_NET_ADMIN rights and a carefully timed race between bnep_add_connection and bnep_del_connection, which reduces real‑world impact even though the theoretical risk remains high.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a75bbcb10cb21acc169b785e9804f57d97873a9c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4907596f25b1720fa948371ac5f6c1f8da10a5bc
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 915a92182e2cda9cd7d2479020a44c6eda986f7c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< fe69f634b076ae3ca81c5a5b845d9bba527036f7
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< b21805258d7e926adfd455fc820a447b90da3b82
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 5506aec795135cdd4cbf4e845929155663b25055
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< e7578529b97e5d4e439cf8f3e637c2303015338f
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 59e932ded949fa6f0340bf7c6d7818f962fa4fd2

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a75bbcb10cb21acc169b785e9804f57d97873a9c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4907596f25b1720fa948371ac5f6c1f8da10a5bc)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,915a92182e2cda9cd7d2479020a44c6eda986f7c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fe69f634b076ae3ca81c5a5b845d9bba527036f7)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b21805258d7e926adfd455fc820a447b90da3b82)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5506aec795135cdd4cbf4e845929155663b25055)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e7578529b97e5d4e439cf8f3e637c2303015338f)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,59e932ded949fa6f0340bf7c6d7818f962fa4fd2)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[5.10.258,5.11.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.142,6.7.0)`	unaffected	semver	—
`[6.12.92,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel patch that addresses the use‑after‑free in BNEP, as released in the supporting commit.
If a patch is not immediately available, consider disabling or removing the Bluetooth BNEP module on hosts that do not require it, thereby eliminating the attack surface.
Limit CAP_NET_ADMIN capabilities to trusted administrators and audit any use of Bluetooth commands that trigger BNEP connections.

Generated by OpenCVE AI on July 30, 2026 at 20:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00249.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4907596f25b1720fa948371ac5f6c1f8da10a5bc
https://git.kernel.org/stable/c/5506aec795135cdd4cbf4e845929155663b25055
https://git.kernel.org/stable/c/59e932ded949fa6f0340bf7c6d7818f962fa4fd2
https://git.kernel.org/stable/c/915a92182e2cda9cd7d2479020a44c6eda986f7c
https://git.kernel.org/stable/c/a75bbcb10cb21acc169b785e9804f57d97873a9c
https://git.kernel.org/stable/c/b21805258d7e926adfd455fc820a447b90da3b82
https://git.kernel.org/stable/c/e7578529b97e5d4e439cf8f3e637c2303015338f
https://git.kernel.org/stable/c/fe69f634b076ae3ca81c5a5b845d9bba527036f7
https://lore.kernel.org/linux-cve-announce/2026071937-CVE-2026-64178-c16a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64178
https://www.cve.org/CVERecord?id=CVE-2026-64178

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026071937-CVE-2026-64178-c16a@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64178 https://www.cve.org/CVERecord?id=CVE-2026-64178
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev->name bnep_add_connection() needs to keep holding the bnep_session_sem while reading dev->name (just like bnep_get_connlist() does); otherwise the bnep_session() thread can concurrently free the net_device, which can for example be triggered by a concurrent bnep_del_connection(). (This UAF is fairly uninteresting from a security perspective; calling bnep_add_connection() requires passing a capable(CAP_NET_ADMIN) check. It also requires completely tearing down a netdev during a fairly tight race window.)
Title		Bluetooth: bnep: Fix UAF read of dev->name
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4907596f25b1720fa948371ac5f6c1f8da10a5bc https://git.kernel.org/stable/c/5506aec795135cdd4cbf4e845929155663b25055 https://git.kernel.org/stable/c/59e932ded949fa6f0340bf7c6d7818f962fa4fd2 https://git.kernel.org/stable/c/915a92182e2cda9cd7d2479020a44c6eda986f7c https://git.kernel.org/stable/c/a75bbcb10cb21acc169b785e9804f57d97873a9c https://git.kernel.org/stable/c/b21805258d7e926adfd455fc820a447b90da3b82 https://git.kernel.org/stable/c/e7578529b97e5d4e439cf8f3e637c2303015338f https://git.kernel.org/stable/c/fe69f634b076ae3ca81c5a5b845d9bba527036f7

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:41:02.293Z

Updated: 2026-08-05T12:39:55.555Z

Reserved: 2026-07-19T07:54:57.039Z

Link: CVE-2026-64178

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64178 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T20:15:05Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object