CVE-2026-64178: Linux Kernel Bluetooth Use-After-Free

CVE-2026-64178 Overview

CVE-2026-64178 is a use-after-free vulnerability in the Linux kernel Bluetooth Network Encapsulation Protocol (BNEP) subsystem. The flaw exists in bnep_add_connection(), which reads dev->name without holding the bnep_session_sem semaphore. A concurrent bnep_session() thread can free the net_device structure during this read, producing a UAF condition. The race can be triggered by a concurrent bnep_del_connection() call. Exploitation requires the CAP_NET_ADMIN capability and successfully winning a tight race window during netdev teardown, which limits practical impact.

Critical Impact
A local attacker with CAP_NET_ADMIN who wins a narrow race during BNEP connection teardown can trigger a kernel use-after-free read of dev->name, potentially leading to memory disclosure or kernel instability.

Affected Products

Linux kernel Bluetooth subsystem (BNEP module)
Distributions shipping vulnerable kernel versions prior to the referenced stable patches
Systems with Bluetooth BNEP functionality enabled

Discovery Timeline

2026-07-19 - CVE-2026-64178 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64178

Vulnerability Analysis

The vulnerability resides in the BNEP subsystem, which enables IP networking over Bluetooth links. The function bnep_add_connection() reads the network device name field dev->name outside the protection of bnep_session_sem. Meanwhile, bnep_get_connlist() correctly holds this semaphore when accessing the same field. This inconsistency creates a race window during which the bnep_session() kernel thread can free the underlying net_device structure. The read then dereferences freed memory, classifying the issue as a use-after-free [CWE-416].

Root Cause

The root cause is missing synchronization. bnep_add_connection() does not maintain the bnep_session_sem across its read of dev->name. Concurrent teardown paths, notably bnep_del_connection(), invoke the session thread which releases the netdev. Without the semaphore, the reader has no guarantee that the device pointer remains valid across the access.

Attack Vector

Triggering the flaw requires local access with the CAP_NET_ADMIN capability, since BNEP connection management is privileged. The attacker must also race netdev teardown within a narrow window by issuing overlapping bnep_add_connection() and bnep_del_connection() operations. The vulnerability is not remotely reachable and no public exploit is available.

No verified proof-of-concept code is available. The upstream fix extends the bnep_session_sem hold across the dev->name read in bnep_add_connection(), mirroring the locking pattern already used by bnep_get_connlist(). Refer to the Kernel Git Commit fe69f63 for the corrective patch.

Detection Methods for CVE-2026-64178

Indicators of Compromise

Kernel oops or panic messages referencing bnep_add_connection or bnep_session in dmesg output
KASAN reports flagging use-after-free reads within the BNEP module on systems with sanitizers enabled
Unexpected process crashes or elevated system instability correlated with Bluetooth PAN activity

Detection Strategies

Audit kernel versions across the fleet and compare against the fixed commits referenced in stable trees
Monitor for anomalous CAP_NET_ADMIN usage combined with rapid BNEP connection add/delete cycles
Deploy KASAN-enabled kernels in test environments to surface UAF conditions before production exposure

Monitoring Recommendations

Collect and centralize dmesg and journalctl -k output to identify kernel-level faults tied to BNEP
Alert on repeated invocations of Bluetooth PAN tooling such as bnep ioctls from non-standard processes
Track loading and unloading of the bnep kernel module on systems that do not require Bluetooth networking

How to Mitigate CVE-2026-64178

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable git commits, including Kernel Git Commit fe69f63 and Kernel Git Commit 4907596
Update to distribution kernel packages that incorporate the BNEP locking fix
Restrict CAP_NET_ADMIN to a minimal set of trusted administrative accounts

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Relevant commits include 4907596, 5506aec, 59e932d, 915a921, a75bbcb, b218052, e757852, and fe69f63. Consult the distribution security advisory for backported package versions.

Workarounds

Blacklist the bnep kernel module on systems that do not require Bluetooth PAN functionality
Disable the Bluetooth service entirely on servers and endpoints where it is not needed
Remove CAP_NET_ADMIN from unprivileged user contexts and container workloads that do not require network administration

bash

# Configuration example: blacklist the bnep module
echo 'blacklist bnep' | sudo tee /etc/modprobe.d/blacklist-bnep.conf
sudo rmmod bnep 2>/dev/null || true
sudo update-initramfs -u