CVE-2026-64433: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64433 Overview

CVE-2026-64433 is a use-after-free vulnerability in the Linux kernel Bluetooth Management (MGMT) subsystem. The flaw resides in the add_device_complete() function in net/bluetooth/mgmt.c. The function executes from the hci_cmd_sync_work kworker and calls hci_conn_params_lookup() without holding hci_dev_lock. A concurrent MGMT_OP_REMOVE_DEVICE operation can free the returned hci_conn_params object through hci_conn_params_free() before the subsequent params->flags dereference occurs. KASAN reports confirmed the slab-use-after-free condition during testing.

Critical Impact
A local attacker with the ability to issue concurrent Bluetooth MGMT commands can trigger a use-after-free read of freed slab memory, potentially leading to kernel memory corruption or information disclosure.

Affected Products

Linux kernel Bluetooth subsystem (net/bluetooth/mgmt.c)
Kernel builds containing the add_device_complete() and hci_conn_params_lookup() code paths
Stable kernel branches prior to the fix commits referenced in git.kernel.org

Discovery Timeline

2026-07-25 - CVE-2026-64433 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64433

Vulnerability Analysis

The defect is a classic race condition between two Bluetooth MGMT code paths that produces a use-after-free [CWE-416]. The add_device_complete() handler runs on the hci_cmd_sync_work kworker and holds only hci_req_sync_lock. It invokes hci_conn_params_lookup(hdev, &cp->addr.bdaddr, le_addr_type(cp->addr.type)) and later reads params->flags when emitting the device_flags_changed event.

hci_conn_params_lookup() walks the hdev->le_conn_params list and is documented to require hdev->lock. Without that lock, a concurrent MGMT_OP_REMOVE_DEVICE handled by remove_device() — which does hold hci_dev_lock — can call hci_conn_params_free() to list_del() and kfree() the same object. The subsequent read in add_device_complete() then touches freed slab memory.

Root Cause

The root cause is a violation of the locking contract for hci_conn_params_lookup(). The lookup returns a pointer to an object protected by hci_dev_lock, but the caller in add_device_complete() never acquires that lock before dereferencing the returned pointer. This allows the object lifetime to end between lookup and use.

Attack Vector

Exploitation requires local access to the Bluetooth MGMT socket, typically granted to privileged users or processes with CAP_NET_ADMIN. An attacker races an add_device MGMT command against a remove_device operation targeting the same Bluetooth address. Winning the race produces a KASAN-detectable slab-use-after-free at add_device_complete+0x358 (per the reporter's trace), which can be shaped into kernel memory disclosure or corruption depending on slab reuse.

No verified proof-of-concept code is published for CVE-2026-64433.
See the upstream commits on git.kernel.org for the exact patch diff
and KASAN report reproduction details.

Detection Methods for CVE-2026-64433

Indicators of Compromise

KASAN reports of slab-use-after-free in add_device_complete in kernel logs
Kernel oops or panic traces referencing hci_cmd_sync_work and net/bluetooth/mgmt.c:7671
Unexpected Bluetooth stack instability following bursts of MGMT add_device and remove_device commands from the same process

Detection Strategies

Enable KASAN on test kernels to surface the use-after-free during fuzzing of the Bluetooth MGMT interface
Audit process access to /dev/bluetooth and MGMT sockets, particularly usage patterns issuing paired add_device/remove_device operations at high frequency
Correlate kernel ring buffer entries mentioning hci_conn_params_lookup with process ancestry to identify anomalous callers

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a central log store and alert on KASAN or BUG: entries containing bluetooth symbols
Track installed kernel package versions across the fleet and flag hosts running builds prior to the patched commits
Monitor for unexpected loads of the bluetooth and bnep kernel modules on servers where Bluetooth is not required

How to Mitigate CVE-2026-64433

Immediate Actions Required

Upgrade to a Linux kernel build that includes the fix commits referenced on git.kernel.org (for example fa85d985f614bc3feb343000f14a1072e99b0df1 and the backports 9531014c60c8, b346efa825b5, caed4a96d557, e4369e4e970f)
On systems that do not require Bluetooth, blacklist the bluetooth and btusb kernel modules to eliminate exposure
Restrict CAP_NET_ADMIN and access to Bluetooth MGMT sockets to trusted service accounts only

Patch Information

The fix acquires hci_dev_lock() across both the hci_conn_params_lookup() call and the subsequent read of params->flags and event emission in add_device_complete(). This honors the documented locking contract and prevents a concurrent remove_device() from freeing the object mid-use. Patch commits are published on the upstream stable tree at git.kernel.org stable commits.

Workarounds

Disable the Bluetooth service (systemctl disable --now bluetooth) on hosts that do not need it
Unload the Bluetooth kernel modules with rmmod and add them to /etc/modprobe.d/ blacklist files to prevent reload
Limit which local users may open AF_BLUETOOTH sockets using seccomp or LSM policies (SELinux, AppArmor)

bash

# Configuration example: blacklist Bluetooth modules until patched kernel is deployed
cat <<'EOF' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
blacklist bluetooth
blacklist btusb
blacklist bnep
blacklist btrtl
blacklist btintel
blacklist btbcm
install bluetooth /bin/true
EOF

sudo systemctl disable --now bluetooth.service
sudo update-initramfs -u