CVE-2026-64144: Linux Kernel Bluetooth Memory Leak Flaw

CVE-2026-64144 Overview

CVE-2026-64144 is a memory leak vulnerability in the Linux kernel's Bluetooth btmtk driver, which supports MediaTek Bluetooth USB devices. The flaw exists in the control URB (USB Request Block) error handling logic. When usb_submit_urb fails or a submitted URB is killed, the driver does not free the associated setup_packet buffer. Each failure path leaks kernel memory allocated for the control transfer setup packet. Repeated triggering of the error condition can gradually exhaust kernel memory on affected systems.

Critical Impact
Repeated URB submission failures in the btmtk driver leak kernel memory, degrading system stability on hosts with MediaTek Bluetooth adapters.

Affected Products

Linux kernel versions containing the vulnerable btmtk Bluetooth driver code
Systems using MediaTek USB Bluetooth adapters bound to the btmtk driver
Distributions shipping kernels prior to the referenced stable commits

Discovery Timeline

2026-07-19 - CVE-2026-64144 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64144

Vulnerability Analysis

The btmtk driver in the Linux kernel manages Bluetooth transport for MediaTek USB chipsets. Control URBs are used to send setup packets over the USB control endpoint. The driver allocates a setup_packet buffer and attaches it to the URB via urb->setup_packet before submission. On the success path, the completion handler releases this buffer. However, two error paths do not release the buffer.

When usb_submit_urb returns an error, the URB is never queued, so the completion callback never runs. The driver returns the error without freeing setup_packet. Similarly, when a submitted URB is killed through usb_kill_urb before completion, the setup buffer allocation is not released. Each occurrence leaks a small kernel allocation, and repeated device errors, resets, or disconnects can accumulate leaks over time.

Root Cause

The root cause is missing cleanup logic in two btmtk error paths. The driver assumes the URB completion handler will always free urb->setup_packet, but this assumption breaks when the URB is never completed. This is a classic kernel memory leak [CWE-401] pattern in USB driver code.

Attack Vector

Triggering the leak requires conditions that cause usb_submit_urb to fail or the URB to be killed. Such conditions include USB bus errors, device disconnects during initialization, or repeated interface resets. A local attacker with physical access to a system with a MediaTek Bluetooth adapter could induce the error condition through repeated device attach and detach cycles. The vulnerability does not provide code execution or privilege escalation. Its impact is limited to kernel memory exhaustion and potential denial of service on long-running systems.

The fix, distributed across kernel stable trees, adds explicit kfree calls for urb->setup_packet in both error paths. See the upstream commits in the Linux kernel stable tree for the patch details.

Detection Methods for CVE-2026-64144

Indicators of Compromise

Growing Slab or SUnreclaim values in /proc/meminfo on systems with MediaTek Bluetooth adapters
Repeated btmtk or usb_submit_urb failure messages in dmesg and kernel logs
Kernel memory leak reports from kmemleak referencing btmtk allocation sites

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on test kernels and scan for allocations tied to btmtk control URB paths
Track kernel slab growth over time and correlate spikes with Bluetooth device events
Audit installed kernel package versions against the fixed stable releases referenced in the CVE advisory

Monitoring Recommendations

Monitor dmesg for repeated Bluetooth: btmtk warnings and USB submission errors
Alert on unusual growth in kernel non-reclaimable memory on hosts with MediaTek Bluetooth hardware
Include kernel version and patch level in endpoint inventory checks

How to Mitigate CVE-2026-64144

Immediate Actions Required

Identify systems running vulnerable kernel versions with MediaTek Bluetooth USB adapters in use
Apply the kernel update from your distribution containing the referenced stable commits
Reboot affected hosts to load the patched kernel after installation

Patch Information

The fix is committed in the Linux kernel stable trees across multiple release branches. Reference commits include 0d2572bafea3, 2a1905730e0c, 68c027c2003b, a0f5268c77eb, and dd1dda6b8d6e. Consult your distribution vendor for the specific package version containing these commits. The patch adds kfree(urb->setup_packet) calls in the usb_submit_urb failure path and the URB kill path within the btmtk driver.

Workarounds

Unbind the btmtk driver on systems that do not require MediaTek Bluetooth functionality using echo -n <device> > /sys/bus/usb/drivers/btusb/unbind
Blacklist the btusb module on hosts that do not require Bluetooth via /etc/modprobe.d/
Physically disconnect or disable MediaTek Bluetooth USB adapters until the patched kernel is deployed

bash

# Verify running kernel and check for the fix
uname -r

# Blacklist btusb where Bluetooth is not needed
echo "blacklist btusb" | sudo tee /etc/modprobe.d/disable-btusb.conf
sudo update-initramfs -u

# Monitor kernel slab usage over time
watch -n 5 'grep -E "Slab|SUnreclaim" /proc/meminfo'