CVE-2026-64405: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64405 Overview

CVE-2026-64405 is a null pointer dereference vulnerability in the Linux kernel Bluetooth subsystem. The flaw resides in hci_abort_conn() within hci_conn.c, where the function reads hci_skb_event(hdev->sent_cmd) while a connection is pending. The hdev->sent_cmd pointer can be NULL while req_status remains HCI_REQ_PEND, triggering a null pointer dereference and a general protection fault from the hci_rx_work() receive path. The upstream fix restructures how in-flight create connection commands are tracked and cancelled, adding a per-connection HCI_CONN_CREATE flag and routing cancellation through hci_cancel_connect_sync().

Critical Impact
The bug produces a kernel general protection fault reachable via the Bluetooth HCI receive path, resulting in kernel crash and denial of service on affected Linux systems.

Affected Products

Linux kernel Bluetooth subsystem (net/bluetooth/hci_conn.c)
Stable kernel branches receiving the referenced backports
Systems using the Bluetooth HCI stack with active connection handling

Discovery Timeline

2026-07-25 - CVE-2026-64405 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64405

Vulnerability Analysis

The vulnerability is a null pointer dereference [CWE-476] in the Linux kernel Host Controller Interface (HCI) connection management code. hci_abort_conn() inspects hdev->sent_cmd to determine which command is in flight when tearing down a pending connection. The receive worker hci_rx_work() can reach this code path when req_status is still HCI_REQ_PEND but hdev->sent_cmd has already been cleared, producing a kernel general protection fault.

Beyond the immediate null dereference, the surrounding logic also risks cancelling an unrelated command that becomes pending between the check and the cancellation call. The patch replaces pointer inspection with a per-connection HCI_CONN_CREATE flag and serializes decisions under cmd_sync_work_lock, keeping the flag test and hci_cmd_sync_cancel() atomic relative to the command worker.

Root Cause

The root cause is unsafe inspection of the shared hdev->sent_cmd field without synchronization against the command dispatch worker. The create connection command exists in one of two states, queued or in flight, but the previous code could observe a transient NULL value while the request status still indicated a pending command. Additionally, hci_acl_create_conn_sync() and hci_le_create_conn_sync() clear the create state after completion, but the command status handler can free the connection via hci_conn_del() while the worker is still blocked on the connection complete event, creating a use-after-free window.

Attack Vector

Triggering the fault requires induction of specific Bluetooth connection state transitions, such as controller-side rejection of a create connection command while cancellation is issued concurrently. A local attacker with control over Bluetooth operations, or a nearby attacker able to influence controller responses during connection setup, can drive the race and crash the kernel. The vulnerability manifests through the hci_rx_work() receive path. See the referenced kernel commits for the exact code paths and fix logic.

// No verified proof-of-concept code is available for CVE-2026-64405.
// Refer to the upstream kernel commits for the corrected logic:
//   - hci_abort_conn() no longer dereferences hdev->sent_cmd directly
//   - HCI_CONN_CREATE flag tracks in-flight create commands per connection
//   - hci_cancel_connect_sync() serializes cancellation under cmd_sync_work_lock

Detection Methods for CVE-2026-64405

Indicators of Compromise

Kernel oops or general protection fault backtraces referencing hci_abort_conn, hci_rx_work, or hci_skb_event in dmesg and /var/log/kern.log.
Unexpected reboots or Bluetooth stack resets on systems with active HCI connection activity.
Repeated Bluetooth connection abort or cancel events preceding kernel crashes.

Detection Strategies

Collect kernel crash dumps and correlate stack frames against the vulnerable hci_conn.c symbols to identify exploitation attempts or accidental triggers.
Monitor journald and kmsg for BUG: and general protection fault entries tied to the Bluetooth subsystem.
Track kernel package versions across the fleet and flag hosts running kernels that predate the referenced stable commits.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on Bluetooth-related fault signatures.
Inventory endpoints and IoT devices with Bluetooth enabled, particularly those exposed to untrusted radio environments.
Review Bluetooth activity on servers where the subsystem is loaded but unused, and consider unloading the module.

How to Mitigate CVE-2026-64405

Immediate Actions Required

Apply the stable kernel updates containing the fix commits referenced by the CVE: 12917f5, 6170191, 70c397b, 83b22d7, 903227b, and b42cb64.
Reboot affected hosts after patching to load the corrected kernel image.
Disable Bluetooth on systems where it is not required until patches are deployed.

Patch Information

The fix is available in the upstream Linux kernel and backported to stable branches. See the Kernel Git Commit 12917f5, Kernel Git Commit 6170191, Kernel Git Commit 70c397b, Kernel Git Commit 83b22d7, Kernel Git Commit 903227b, and Kernel Git Commit b42cb64. Consume the corresponding stable release from your distribution vendor as soon as it is published.

Workarounds

Unload the Bluetooth kernel module (rmmod bluetooth) on systems that do not require Bluetooth connectivity.
Blacklist the bluetooth and btusb modules in /etc/modprobe.d/ to prevent load at boot.
Restrict physical and radio proximity access to endpoints that must run vulnerable kernels until patched.

bash

# Disable and blacklist the Bluetooth stack until the kernel is patched
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service

cat <<'EOF' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
blacklist bluetooth
blacklist btusb
blacklist btintel
EOF

sudo rmmod btusb bluetooth 2>/dev/null || true