CVE-2026-64406 Bluetooth: fix UAF in bt_accept_dequeue()

🗓️ 25 Jul 2026 08:50:47Reported by GoogleType

osv🔗 osv.dev👁 1 Views

Fix UAF in bt_accept_dequeue by retaining the temporary queue reference through unlink and handing to caller on success.

Reporter	Title	Published	Views	Family All 10
CVE	CVE-2026-64406	25 Jul 202608:50	–	cve
Cvelist	CVE-2026-64406 Bluetooth: fix UAF in bt_accept_dequeue()	25 Jul 202608:50	–	cvelist
Debian CVE	CVE-2026-64406	25 Jul 202608:50	–	debiancve
EUVD	EUVD-2026-48950	25 Jul 202608:50	–	euvd
NVD	CVE-2026-64406	25 Jul 202610:17	–	nvd
OSV	DEBIAN-CVE-2026-64406	25 Jul 202610:17	–	osv
OSV	ECHO-3E5F-16F9-0C5F	26 Jul 202602:26	–	osv
Positive Technologies	PT-2026-64627	25 Jul 202600:00	–	ptsecurity
SUSE CVE	SUSE CVE-2026-64406	25 Jul 202615:59	–	susecve
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-64406	25 Jul 202600:00	–	nessus

Source	Link
git	www.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
git	www.git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0
git	www.git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614
git	www.git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9a
git	www.git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049
git	www.git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1db
git	www.git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547
git	www.git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8d
git	www.git.kernel.org/stable/c/c66a95e60b65d876a927123b0ed36bd6177d9ca6
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64406.json

26 Jul 2026 05:17Current

5.7Medium risk

Vulners AI Score5.7

EPSS0.0022