From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7BCA838F230 for ; Sat, 25 Jul 2026 09:00:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784970045; cv=none; b=Vcu5rW2YuqbUdo5NDDbmJunKElEaMdLhgrywvuIkAE8ELCnIwgUc9+aFK7xmAiwrOPyfQuR9sRMbNFDrj5wmIOnzyCt1hHHji51AGV4M+YoKLcMGClh4LKo0/MX0ihZQHBVR9QBFFadJVOMsYBsGq2A6xcj2/0QJvrDnzdasrm8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784970045; c=relaxed/simple; bh=lAnhfiCcXP1Ad1NjIYlGOgeh/XZzs+nOHL8nv4LmQIc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=dJkfZyj9rJHuIKvq124D24hvgF1RuRQIzqL1PlnbfMfZhrEIVftYjTIKymp7JPHvUE4kIl+JAuYAU92OOahlG2IV19BNyYnY7h/ezsYYhBI5SduQw03Zm1K8+f80m1j9qVuw4C3lniUQLfwebUaBUEh8U/Pa7T/cezFYGWSiwQs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=g5+u6V0m; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="g5+u6V0m" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF4AA1F000E9; Sat, 25 Jul 2026 09:00:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784970044; bh=TTidMJdvKMVY6TOp1mdYAQ0OZxStSG7Oux2qc5yMFak=; h=From:To:Cc:Subject:Date:Reply-To; b=g5+u6V0mCVoXg+4DNdv7LrfxgGDYFTfmbUi0gq65Tvv237gO27xHbXTWgJDKJACC5 vSU03n/f2RJVgCVVEi4SxCxCVkTgX8DdzlsEGVRsbArMjgb71I4mnQUx8gK7kEA4KN 0FQepnaxMbWBI3WXmKOsD3W67XrcWEyUVDAWfEpk= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64471: Bluetooth: btusb: fix use-after-free on registration failure Date: Sat, 25 Jul 2026 10:51:28 +0200 Message-ID: <2026072545-CVE-2026-64471-0da2@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3444; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=y4TL0HFAA4Fd/QJfuhHK4cpgM4vnh1pwmwj5wXVlfvo=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkpFXkcV152dAgFWpc1vdqQ9Le6ofKUq8bvjcUtq36kT tgkYn+/I5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACZyX4ZhfuSZqW4friZnXE6I W/Riwu+EffP/MzEsmJKuum3bHFamN0XPskP6+1q5X+W5AQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on registration failure Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected. This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths. The Linux kernel CVE team has assigned CVE-2026-64471 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.27 with commit 9bfa35fe422c74882e27cc54450a5f76c96aad68 and fixed in 5.10.261 with commit e09ac7d0c6859a360bf36e7104aef03f88184e0b Issue introduced in 2.6.27 with commit 9bfa35fe422c74882e27cc54450a5f76c96aad68 and fixed in 5.15.212 with commit 468fcdfaeb937163dd250773a9fed17ab1fa203c Issue introduced in 2.6.27 with commit 9bfa35fe422c74882e27cc54450a5f76c96aad68 and fixed in 6.1.178 with commit 1ce5012944afaddbda939ec6bae9800fce84abbc Issue introduced in 2.6.27 with commit 9bfa35fe422c74882e27cc54450a5f76c96aad68 and fixed in 6.6.145 with commit e6313b800da61a26c2fdd5eba0105e197c0ab3bc Issue introduced in 2.6.27 with commit 9bfa35fe422c74882e27cc54450a5f76c96aad68 and fixed in 6.12.96 with commit 14e02f1449ba425a44dedbec9a21efafb056e09f Issue introduced in 2.6.27 with commit 9bfa35fe422c74882e27cc54450a5f76c96aad68 and fixed in 6.18.39 with commit 8db0ce3de78367f61c2970c0f16d9adee8830a23 Issue introduced in 2.6.27 with commit 9bfa35fe422c74882e27cc54450a5f76c96aad68 and fixed in 7.1.4 with commit da7d7758fe884b256ddc9fef562e5ddef7952383 Issue introduced in 2.6.27 with commit 9bfa35fe422c74882e27cc54450a5f76c96aad68 and fixed in 7.2-rc1 with commit eedc6867ebad73edbfaf9a0a65fbef7115cc4753 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64471 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/bluetooth/btusb.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/e09ac7d0c6859a360bf36e7104aef03f88184e0b https://git.kernel.org/stable/c/468fcdfaeb937163dd250773a9fed17ab1fa203c https://git.kernel.org/stable/c/1ce5012944afaddbda939ec6bae9800fce84abbc https://git.kernel.org/stable/c/e6313b800da61a26c2fdd5eba0105e197c0ab3bc https://git.kernel.org/stable/c/14e02f1449ba425a44dedbec9a21efafb056e09f https://git.kernel.org/stable/c/8db0ce3de78367f61c2970c0f16d9adee8830a23 https://git.kernel.org/stable/c/da7d7758fe884b256ddc9fef562e5ddef7952383 https://git.kernel.org/stable/c/eedc6867ebad73edbfaf9a0a65fbef7115cc4753