CVE-2026-64470 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Bluetooth device manufacturers, Linux distribution maintainers, and security teams should assess exposure and apply patches or mitigations as necessary. They should also verify Linux kernel versions, Bluetooth device configurations, and system logs to prevent potential use-after-free errors.

Why it matters

A use-after-free vulnerability in the Linux kernel's Bluetooth btusb module requires verification of Linux kernel versions and Bluetooth device configurations, application of kernel patches, and monitoring of system logs to prevent potential use-after-free errors.

• Verify Linux kernel versions and Bluetooth device configurations to identify potential exposure.
• Apply kernel patches or updates to fix the use-after-free vulnerability.
• Monitor system logs for potential use-after-free errors related to the btusb module.

Technical summary

The Linux kernel's Bluetooth btusb module is vulnerable to a use-after-free issue. When Marvell OOB wakeup configuration fails during probe, TX URBs are not stopped, leading to a use-after-free in the completion callback. This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in btusb probe errors paths. The affected product context includes Linux kernel versions and Bluetooth device configurations. The defensive impact requires verification of Linux kernel versions, application of kernel patches, and monitoring of system logs.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to fix the use-after-free vulnerability in the Bluetooth btusb module.
• Verify the configuration of Marvell OOB wakeup to prevent probe failures.
• Monitor Linux kernel updates for further fixes related to this vulnerability.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the scope of affected systems and versions is not explicitly stated, requiring further verification of Linux kernel versions, Bluetooth device configurations, and system logs. The evidence limits are based on the provided source corpus, and defenders should verify the affected scope, severity, and vendor guidance. The known affected scope includes Linux kernel versions and Bluetooth device configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.