CVE-2026-64405 - Vulnerability Details

- Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()

hci_abort_conn() read hci_skb_event(hdev->sent_cmd) when a connection
was pending, but hdev->sent_cmd can be NULL while req_status is still
HCI_REQ_PEND, leading to a NULL pointer dereference and a general
protection fault from the hci_rx_work() receive path.

Instead of inspecting hdev->sent_cmd, track the in-flight create
connection command with a new per-connection HCI_CONN_CREATE flag and
route all cancellation through hci_cancel_connect_sync(), which
dispatches to a dedicated per-type cancel function. The create command
is in exactly one of two states: still queued, or in flight. The cancel
function holds cmd_sync_work_lock across the whole decision: the worker
takes this lock to dequeue every entry, so while it is held a queued
command cannot start running and an in-flight command cannot complete
and let the next command become pending. This keeps the flag test and
hci_cmd_sync_cancel() atomic with respect to the worker, so a queued
command is simply dequeued, and an in-flight command owned by this
connection is cancelled without the risk of cancelling an unrelated
command that became pending in the meantime. CIS uses the same flag
mechanism via HCI_CONN_CREATE_CIS but cannot be dequeued per-connection.

hci_acl_create_conn_sync() and hci_le_create_conn_sync() clear
HCI_CONN_CREATE after the create command completes, but the command
status handler can free conn via hci_conn_del() (for example when the
controller rejects the connection) while the worker is still blocked on
the connection complete event. Hold a reference on conn across the
create command so the flag can be cleared without a use-after-free.

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability is a null pointer dereference in the Linux kernel Bluetooth stack. When the hci_abort_conn() function is called while a connection is pending but the hdev->sent_cmd pointer is NULL, the code reads from a NULL address, causing a general protection fault. The fault occurs in the hci_rx_work() receive path and results in a kernel crash, which can be used to deny service to legitimate users. The fix introduces per-connection tracking flags to avoid dereferencing NULL and ensures atomic cancellation of in‑flight commands.

Affected Systems

The bug resides in the Linux kernel Bluetooth stack and affects all kernel releases that include the hci_abort_conn() implementation before the patch commit. Vendors listed as impacted are Linux distributions that ship the unpatched kernel. No specific version range is provided, so any in‑use kernel containing the vulnerable code is at risk.

Risk and Exploitability

The EPSS score is below 1 % and there is no listing in CISA KEV, indicating a very low exploitation probability. The CVSS score of 5.5 reflects moderate severity, yet the vulnerability can cause a complete kernel crash, a practical denial‑of‑service risk. The likely attack vector is remote via the Bluetooth interface, where a malicious device can initiate a connection that triggers the race condition. Because the bug requires a specific timing between pending requests, the difficulty of an attacker is moderate to difficult. Nonetheless, due to the severity of the crash, the issue warrants prompt remediation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6083089ab00631617f9eac678df3ab050a9d837a`	affected	< 903227b6168bb99fd57d4e3c9c1b5014986198e0
`a13f316e90fdb1fb6df6582e845aa9b3270f3581`	affected	< 83b22d7f7c384564fa42c3cf19bec715c693d7a2
`a13f316e90fdb1fb6df6582e845aa9b3270f3581`	affected	< 70c397b62ee015e19b3924d9da741c8dda017819
`a13f316e90fdb1fb6df6582e845aa9b3270f3581`	affected	< 61701912c58a05f6a043f097cc177a964abef348
`a13f316e90fdb1fb6df6582e845aa9b3270f3581`	affected	< b42cb640a0493d16b61ddd267420274be15efdc1
`a13f316e90fdb1fb6df6582e845aa9b3270f3581`	affected	< 12917f591cea1af36087dba5b9ec888652f0b42a
`e4511a67fcdba9729d1c7cfc6d2e645c765ce801`	affected	—
`4ab81f16c68a602b2b69e333ae08d8748a9398de`	affected	—
`6.1.83`	affected	< 6.1.118
`6.4.16`	affected	< 6.5
`6.5.3`	affected	< 6.6

Linux

affected

Version	Status	Constraints
`6.6`	affected	—
`0`	unaffected	< 6.6
`6.1.118`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6083089ab00631617f9eac678df3ab050a9d837a,903227b6168bb99fd57d4e3c9c1b5014986198e0)`	affected	code_commit	—
`[a13f316e90fdb1fb6df6582e845aa9b3270f3581,83b22d7f7c384564fa42c3cf19bec715c693d7a2)`	affected	code_commit	—
`[a13f316e90fdb1fb6df6582e845aa9b3270f3581,70c397b62ee015e19b3924d9da741c8dda017819)`	affected	code_commit	—
`[a13f316e90fdb1fb6df6582e845aa9b3270f3581,61701912c58a05f6a043f097cc177a964abef348)`	affected	code_commit	—
`[a13f316e90fdb1fb6df6582e845aa9b3270f3581,b42cb640a0493d16b61ddd267420274be15efdc1)`	affected	code_commit	—
`[a13f316e90fdb1fb6df6582e845aa9b3270f3581,12917f591cea1af36087dba5b9ec888652f0b42a)`	affected	code_commit	—
`e4511a67fcdba9729d1c7cfc6d2e645c765ce801`	affected	code_commit	—
`4ab81f16c68a602b2b69e333ae08d8748a9398de`	affected	code_commit	—
`[6.1.83,6.1.118)`	affected	semver	—
`[6.4.16,6.5)`	affected	semver	—
`[6.5.3,6.6)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.6`	affected	semver	—
`[0,6.6)`	unaffected	semver	—
`[6.1.118,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the patch (commit references in the advisory); apply the latest vendor update for the kernel.
Disable or block Bluetooth traffic if the device does not require it; for example, use rfkill or firewall rules to restrict Bluetooth connections until the patch is applied.
Monitor Bluetooth activity for abnormal connection attempts and consider temporarily suspending the Bluetooth service to avoid exploitation while waiting for an update.

Generated by OpenCVE AI on August 4, 2026 at 14:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4724-1	linux-6.12 new package
Debian DSA	DSA-6405-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/12917f591cea1af36087dba5b9ec888652f0b42a
https://git.kernel.org/stable/c/61701912c58a05f6a043f097cc177a964abef348
https://git.kernel.org/stable/c/70c397b62ee015e19b3924d9da741c8dda017819
https://git.kernel.org/stable/c/83b22d7f7c384564fa42c3cf19bec715c693d7a2
https://git.kernel.org/stable/c/903227b6168bb99fd57d4e3c9c1b5014986198e0
https://git.kernel.org/stable/c/b42cb640a0493d16b61ddd267420274be15efdc1
https://lore.kernel.org/linux-cve-announce/2026072530-CVE-2026-64405-7769@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64405
https://www.cve.org/CVERecord?id=CVE-2026-64405

History

Thu, 30 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072530-CVE-2026-64405-7769@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64405 https://www.cve.org/CVERecord?id=CVE-2026-64405
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 26 Jul 2026 02:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() hci_abort_conn() read hci_skb_event(hdev->sent_cmd) when a connection was pending, but hdev->sent_cmd can be NULL while req_status is still HCI_REQ_PEND, leading to a NULL pointer dereference and a general protection fault from the hci_rx_work() receive path. Instead of inspecting hdev->sent_cmd, track the in-flight create connection command with a new per-connection HCI_CONN_CREATE flag and route all cancellation through hci_cancel_connect_sync(), which dispatches to a dedicated per-type cancel function. The create command is in exactly one of two states: still queued, or in flight. The cancel function holds cmd_sync_work_lock across the whole decision: the worker takes this lock to dequeue every entry, so while it is held a queued command cannot start running and an in-flight command cannot complete and let the next command become pending. This keeps the flag test and hci_cmd_sync_cancel() atomic with respect to the worker, so a queued command is simply dequeued, and an in-flight command owned by this connection is cancelled without the risk of cancelling an unrelated command that became pending in the meantime. CIS uses the same flag mechanism via HCI_CONN_CREATE_CIS but cannot be dequeued per-connection. hci_acl_create_conn_sync() and hci_le_create_conn_sync() clear HCI_CONN_CREATE after the create command completes, but the command status handler can free conn via hci_conn_del() (for example when the controller rejects the connection) while the worker is still blocked on the connection complete event. Hold a reference on conn across the create command so the flag can be cleared without a use-after-free.
Title		Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/12917f591cea1af36087dba5b9ec888652f0b42a https://git.kernel.org/stable/c/61701912c58a05f6a043f097cc177a964abef348 https://git.kernel.org/stable/c/70c397b62ee015e19b3924d9da741c8dda017819 https://git.kernel.org/stable/c/83b22d7f7c384564fa42c3cf19bec715c693d7a2 https://git.kernel.org/stable/c/903227b6168bb99fd57d4e3c9c1b5014986198e0 https://git.kernel.org/stable/c/b42cb640a0493d16b61ddd267420274be15efdc1

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:47.262Z

Updated: 2026-07-25T08:50:47.262Z

Reserved: 2026-07-19T15:36:31.786Z

Link: CVE-2026-64405

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:24.110

Modified: 2026-08-11T15:01:50.637

Link: CVE-2026-64405

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64405 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T14:30:10Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object