CVE-2026-64408: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64408 Overview

CVE-2026-64408 is a use-after-free vulnerability in the Linux kernel's Bluetooth Network Encapsulation Protocol (BNEP) subsystem. The flaw exists in bnep_add_connection(), which reads the Logical Link Control and Adaptation Protocol (L2CAP) connection without holding the channel lock. The function then passes the associated Host Controller Interface (HCI) device to register_netdev(). A concurrent controller teardown can clear and release that connection, causing the network device registration path to dereference a freed parent device. The vulnerability affects adjacent-network attackers within Bluetooth range and can lead to kernel memory corruption, denial of service, or potential code execution.

Critical Impact
An attacker within Bluetooth range can trigger a race condition during BNEP connection setup, leading to a use-after-free on a freed HCI parent device with high impact to confidentiality, integrity, and availability.

Affected Products

Linux kernel Bluetooth stack (BNEP module)
Linux distributions shipping vulnerable kernel versions prior to the fix commits
Systems with Bluetooth hardware and BNEP enabled for PAN networking

Discovery Timeline

2026-07-25 - CVE-2026-64408 published to the National Vulnerability Database
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64408

Vulnerability Analysis

The vulnerability resides in the BNEP subsystem, which enables IP networking over Bluetooth using the Personal Area Network (PAN) profile. When a userspace process establishes a BNEP session, bnep_add_connection() accesses the underlying L2CAP socket to retrieve the associated HCI device pointer. This pointer is then used as the parent device when the BNEP driver calls register_netdev() to publish a new network interface.

The read of the L2CAP connection occurs without acquiring the channel lock. This leaves a window in which controller teardown, driven by adapter removal or disconnection, can clear the connection reference and release the underlying HCI device. When the netdev registration path subsequently dereferences the parent device pointer, it operates on freed memory.

The attack requires adjacent-network access, meaning the attacker must be within Bluetooth radio range. No privileges or user interaction are required on the victim system to trigger the race once a BNEP connection attempt is in progress.

Root Cause

The root cause is missing synchronization between the BNEP connection setup path and the HCI controller teardown path. bnep_add_connection() reads and uses l2cap_pi(sock->sk)->chan->conn without holding the L2CAP channel lock and without taking a reference on the connection object. Because the connection lifetime is not pinned during the window between the read and the successful completion of register_netdev(), concurrent teardown can free the parent HCI device while it is still being referenced.

Attack Vector

The attack vector is Adjacent Network (AV:A). An attacker in Bluetooth proximity can initiate or influence BNEP connection establishment and induce controller state changes to race the netdev registration. Successful exploitation of the use-after-free can corrupt kernel memory, crash the system, or be leveraged for privilege escalation. The upstream fix takes a reference to the L2CAP connection while holding the channel lock and retains it until register_netdev() has taken its own parent device reference. See the fix commits including Kernel Git Commit 46a88784 and Kernel Git Commit ae215c5b for the exact patch semantics.

Detection Methods for CVE-2026-64408

Indicators of Compromise

Unexpected kernel oops or panic traces referencing bnep_add_connection, register_netdev, or hci_dev_put in dmesg or the systemd journal.
KASAN use-after-free reports naming BNEP or L2CAP structures on kernels built with memory sanitizers enabled.
Unexplained disappearance or renaming of bnep* network interfaces coinciding with Bluetooth adapter reset events.

Detection Strategies

Audit kernel version and Bluetooth module (bnep.ko) against the fix commits referenced in the NVD entry.
Correlate Bluetooth pairing or PAN connection attempts with subsequent kernel warnings to identify race exploitation attempts.
Enable CONFIG_KASAN in test environments to surface use-after-free conditions during Bluetooth stress testing.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on stack traces containing bnep_ or l2cap_ symbols.
Monitor for repeated Bluetooth controller resets or HCI device removals from unprivileged sessions.
Track loading and use of the bnep kernel module on systems where PAN networking is not required.

How to Mitigate CVE-2026-64408

Immediate Actions Required

Update to a Linux kernel version containing the upstream fix commits listed in the NVD advisory.
If patching is not immediately feasible, unload and blacklist the bnep kernel module on systems that do not require Bluetooth PAN.
Disable Bluetooth adapters on servers and endpoints where the radio is not operationally necessary.

Patch Information

The fix is available through multiple stable branch commits. Apply the upstream patches referenced in the NVD entry, including Kernel Git Commit 390b5db3, Kernel Git Commit 46a88784, Kernel Git Commit 551ae773, Kernel Git Commit 563a8573, Kernel Git Commit a6b22dbd, Kernel Git Commit ae215c5b, Kernel Git Commit bb067a99, and Kernel Git Commit df22adc7. Consume the fix from your distribution vendor once available.

Workarounds

Blacklist the BNEP module by adding blacklist bnep to /etc/modprobe.d/bluetooth.conf and rebuilding the initramfs.
Disable the Bluetooth service (systemctl disable --now bluetooth) on systems that do not require Bluetooth connectivity.
Restrict physical proximity by operating sensitive systems in environments where adjacent-network Bluetooth attacks are not feasible.

bash

# Configuration example: prevent BNEP from loading
echo 'blacklist bnep' | sudo tee /etc/modprobe.d/disable-bnep.conf
sudo rmmod bnep 2>/dev/null
sudo update-initramfs -u