CVE-2026-64470 Overview
CVE-2026-64470 is a use-after-free vulnerability in the Linux kernel's Bluetooth USB driver (btusb). The flaw affects the Marvell out-of-band (OOB) wakeup configuration path during device probe. If the probe fails after transmit URBs have been submitted, those URBs are not stopped, causing the completion callback to reference freed memory. The issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe error paths. The upstream fix ensures any TX URBs submitted during Marvell OOB wakeup setup are properly cancelled on later probe failure. Multiple stable kernel branches received backported patches.
Critical Impact
A use-after-free in the btusb completion callback can lead to kernel memory corruption, denial of service, or potential local privilege escalation on systems with affected Marvell Bluetooth USB adapters.
Affected Products
- Linux kernel btusb Bluetooth USB driver
- Systems using Marvell Bluetooth USB adapters with OOB wakeup configuration
- Multiple stable kernel branches (see upstream commit references)
Discovery Timeline
- 2026-07-25 - CVE-2026-64470 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64470
Vulnerability Analysis
The vulnerability resides in the btusb driver, which handles USB-attached Bluetooth controllers in the Linux kernel. During probe of Marvell devices, the driver configures OOB wakeup by submitting transmit (TX) URBs to the USB stack. If a subsequent step in the probe routine fails, the driver frees device state without first cancelling those in-flight URBs.
When the URB later completes, the USB core invokes the driver's completion callback with a pointer to memory that has already been released. This satisfies the classic use-after-free (UAF) condition, where freed memory is accessed through a still-live pointer held by asynchronous kernel machinery.
Root Cause
The root cause is missing cleanup of asynchronous work on an error path. The probe routine submits TX URBs during Marvell OOB wakeup configuration but does not call the corresponding kill/unlink routines when a later probe step returns an error. The freed driver context is then dereferenced by the URB completion callback, producing memory corruption.
Attack Vector
Triggering the flaw requires that a Marvell Bluetooth USB device be present and that its probe reach the OOB wakeup configuration step before failing. An attacker with the ability to attach or hot-plug USB hardware, or influence conditions that induce probe failure, could reach the vulnerable path. Successful exploitation depends on winning a race between memory release and URB completion, so reliability varies with system load and scheduling.
The vulnerability manifests during driver initialization on affected hardware. See the upstream commit references for the exact code changes that stop the TX URBs on the probe failure path.
Detection Methods for CVE-2026-64470
Indicators of Compromise
- Kernel oops or panic messages referencing btusb or the URB completion path in dmesg or journalctl -k
- KASAN reports flagging use-after-free in btusb completion callbacks on kernels built with sanitizers
- Unexpected Bluetooth subsystem failures during boot or USB hot-plug events involving Marvell adapters
Detection Strategies
- Enable KASAN on test and pre-production kernels to surface UAF conditions in the btusb probe path
- Audit installed kernel versions against the upstream fix commits and stable backports listed in the kernel Git references
- Monitor endpoint telemetry for kernel crashes correlated with Bluetooth device enumeration
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and alert on btusb fault signatures
- Track USB device attach events on systems with Marvell Bluetooth hardware to correlate probe failures with crashes
- Include Linux kernel package inventory in vulnerability management scans to identify unpatched hosts
How to Mitigate CVE-2026-64470
Immediate Actions Required
- Update to a Linux kernel version that includes the upstream fix or corresponding stable backport
- Prioritize patching endpoints, laptops, and embedded devices that ship with Marvell Bluetooth USB controllers
- Reboot systems after applying the kernel update to load the fixed btusb module
Patch Information
The fix is available in mainline and multiple stable branches. Refer to the upstream commits: 0ccb1cb0a464, 1edd524de5cc, 631de465aba7, 6e1b10df890f, 838c917a2f16, 92c736866244, a7e941a39571, and c5b600a3c05b. Consume kernel updates through your distribution's package manager where possible.
Workarounds
- Blacklist the btusb module on systems that do not require Bluetooth functionality
- Physically disconnect or disable affected Marvell Bluetooth USB adapters until the kernel is patched
- Restrict physical and administrative access to USB ports on high-value systems to reduce probe-triggering exposure
# Configuration example: prevent btusb from loading until patched
echo 'blacklist btusb' | sudo tee /etc/modprobe.d/blacklist-btusb.conf
sudo update-initramfs -u
# Verify current kernel version against fixed commits
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
