CVE-2026-64471: Bluetooth: btusb: fix use-after-free on registration failure

CVE-2026-64471: Bluetooth: btusb: fix use-after-free on registration failure

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: fix use-after-free on registration failure

Make sure to release the sibling interfaces in case controller
registration fails to avoid use-after-free and double-free when they are
eventually disconnected.

This issue was reported by Sashiko while reviewing a fix for a wakeup
source leak in the btusb probe errors paths.

The Linux kernel CVE team has assigned CVE-2026-64471 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.27 with commit 9bfa35fe422c74882e27cc54450a5f76c96aad68 and fixed in 5.10.261 with commit e09ac7d0c6859a360bf36e7104aef03f88184e0b
	Issue introduced in 2.6.27 with commit 9bfa35fe422c74882e27cc54450a5f76c96aad68 and fixed in 5.15.212 with commit 468fcdfaeb937163dd250773a9fed17ab1fa203c
	Issue introduced in 2.6.27 with commit 9bfa35fe422c74882e27cc54450a5f76c96aad68 and fixed in 6.1.178 with commit 1ce5012944afaddbda939ec6bae9800fce84abbc
	Issue introduced in 2.6.27 with commit 9bfa35fe422c74882e27cc54450a5f76c96aad68 and fixed in 6.6.145 with commit e6313b800da61a26c2fdd5eba0105e197c0ab3bc
	Issue introduced in 2.6.27 with commit 9bfa35fe422c74882e27cc54450a5f76c96aad68 and fixed in 6.12.96 with commit 14e02f1449ba425a44dedbec9a21efafb056e09f
	Issue introduced in 2.6.27 with commit 9bfa35fe422c74882e27cc54450a5f76c96aad68 and fixed in 6.18.39 with commit 8db0ce3de78367f61c2970c0f16d9adee8830a23
	Issue introduced in 2.6.27 with commit 9bfa35fe422c74882e27cc54450a5f76c96aad68 and fixed in 7.1.4 with commit da7d7758fe884b256ddc9fef562e5ddef7952383
	Issue introduced in 2.6.27 with commit 9bfa35fe422c74882e27cc54450a5f76c96aad68 and fixed in 7.2-rc1 with commit eedc6867ebad73edbfaf9a0a65fbef7115cc4753

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64471
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/bluetooth/btusb.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e09ac7d0c6859a360bf36e7104aef03f88184e0b
	https://git.kernel.org/stable/c/468fcdfaeb937163dd250773a9fed17ab1fa203c
	https://git.kernel.org/stable/c/1ce5012944afaddbda939ec6bae9800fce84abbc
	https://git.kernel.org/stable/c/e6313b800da61a26c2fdd5eba0105e197c0ab3bc
	https://git.kernel.org/stable/c/14e02f1449ba425a44dedbec9a21efafb056e09f
	https://git.kernel.org/stable/c/8db0ce3de78367f61c2970c0f16d9adee8830a23
	https://git.kernel.org/stable/c/da7d7758fe884b256ddc9fef562e5ddef7952383
	https://git.kernel.org/stable/c/eedc6867ebad73edbfaf9a0a65fbef7115cc4753