CVE-2026-64433
- Source
- https://cve.org/CVERecord?id=CVE-2026-64433
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64433.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-64433
- Downstream
- Published
- 2026-07-25T08:51:08.432Z
- Modified
- 2026-07-27T04:03:22.612568085Z
- Summary
- Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete
adddevicecomplete() runs from the hcicmdsyncwork kworker, which holds only hcireqsynclock and not hcidevlock. It calls hciconnparamslookup() and then dereferences the returned object (params->flags) without taking hcidev_lock:
params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, le_addr_type(cp->addr.type)); ... device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, hdev->conn_flags, params ? params->flags : 0);hciconnparamslookup() walks hdev->leconnparams and is documented to require hdev->lock. A concurrent MGMTOPREMOVEDEVICE (removedevice()), which does run under hcidevlock, can call hciconnparamsfree() to list_del() and kfree() the very object the lookup returned, so the subsequent params->flags read touches freed memory [0].
Hold hcidevlock() across the hciconnparamslookup() and the read of params->flags (and the matching event emission) so the lookup result cannot be freed by a concurrent removedevice() before it is used, honouring the locking contract of hciconnparams_lookup().
BUG: KASAN: slab-use-after-free in adddevicecomplete+0x358/0x3d8 net/bluetooth/mgmt.c:7671 Read of size 1 at addr ffff000017ab26c1 by task kworker/u9:8/388
CPU: 1 UID: 0 PID: 388 Comm: kworker/u9:8 Not tainted 7.0.11 #20 PREEMPT Hardware name: linux,dummy-virt (DT) Workqueue: hci0 hcicmdsyncwork Call trace: showstack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dumpstack lib/dumpstack.c:94 [inline] dump_stacklvl+0xb4/0xd4 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:378 [inline] printreport+0x118/0x5d8 mm/kasan/report.c:482 kasanreport+0xb0/0xf4 mm/kasan/report.c:595 _asanreportload1noabort+0x20/0x2c mm/kasan/reportgeneric.c:378 adddevicecomplete+0x358/0x3d8 net/bluetooth/mgmt.c:7671 hcicmdsyncwork+0x14c/0x240 net/bluetooth/hcisync.c:334 processonework+0x628/0xd38 kernel/workqueue.c:3289 processscheduledworks kernel/workqueue.c:3372 [inline] workerthread+0x7a8/0xac0 kernel/workqueue.c:3453 kthread+0x39c/0x444 kernel/kthread.c:436 retfromfork+0x10/0x20 arch/arm64/kernel/entry.S:860
Allocated by task 3401: kasansavestack+0x3c/0x64 mm/kasan/common.c:57 kasansavetrack+0x20/0x3c mm/kasan/common.c:78 kasansaveallocinfo+0x40/0x54 mm/kasan/generic.c:570 poisonkmalloc_redzone mm/kasan/common.c:398 [inline] __kasankmalloc+0xd4/0xd8 mm/kasan/common.c:415 kasankmalloc include/linux/kasan.h:263 [inline] __kmalloccachenoprof+0x1b0/0x458 mm/slub.c:5385 kmallocnoprof include/linux/slab.h:950 [inline] kzallocnoprof include/linux/slab.h:1188 [inline] hciconnparamsadd+0x10c/0x4b0 net/bluetooth/hcicore.c:2279 hciconnparamsset net/bluetooth/mgmt.c:5162 [inline] adddevice+0x5b4/0xa54 net/bluetooth/mgmt.c:7755 hcimgmtcmd net/bluetooth/hcisock.c:1721 [inline] hcisocksendmsg+0x10b4/0x1dd0 net/bluetooth/hcisock.c:1841 socksendmsgnosec net/socket.c:727 [inline] __socksendmsg+0xe0/0x128 net/socket.c:742 sockwriteiter+0x250/0x390 net/socket.c:1195 newsyncwrite fs/readwrite.c:595 [inline] vfswrite+0x66c/0xab0 fs/readwrite.c:688 ksyswrite+0x1fc/0x24c fs/readwrite.c:740 __dosyswrite fs/read_write.c:751 [inline] __sesyswrite fs/read_write.c:748 [inline] __arm64syswrite+0x70/0xa4 fs/read_write.c:748 __invokesyscall arch/arm64/kernel/syscall.c:35 [inline] invokesyscall+0x84/0x2a8 arch/arm64/kernel/syscall.c:49 el0svccommon.constprop.0+0xe4/0x294 arch/arm64/kernel/syscall.c:132 doel0svc+0x44/0x5c arch/arm64/kernel/syscall.c:151 el0svc+0x38/0xac arch/arm64/kernel/entry-common.c:724 el0t64synchandler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:743 el0t64sync+0x198/0x19c arch/arm64/kernel/entry.S:596
Freed by task 3740: kasansavestack+0x3c/0x64 ---truncated---
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64433.json" }- References
-
- https://git.kernel.org/stable/c/9531014c60c804e16099885d4a98aedcf31bce8d
- https://git.kernel.org/stable/c/b346efa825b5e4386f19bc63f81141652d496ec4
- https://git.kernel.org/stable/c/caed4a96d55757c139a899744657c032b6186665
- https://git.kernel.org/stable/c/e4369e4e970f3fa4676b76be14c1d315c87f22b6
- https://git.kernel.org/stable/c/fa85d985f614bc3feb343000f14a1072e99b0df1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64433.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-64433
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced31492b8386e5a243df26ca4a9421f6b041f414d5Fixedcaed4a96d55757c139a899744657c032b6186665
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced28826a89fdfd49f3291980c2e68b8a7c5d55e199Fixede4369e4e970f3fa4676b76be14c1d315c87f22b6
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1e2e3044c1bc64a64aa0eaf7c17f7832c26c9775Fixedb346efa825b5e4386f19bc63f81141652d496ec4Fixed9531014c60c804e16099885d4a98aedcf31bce8dFixedfa85d985f614bc3feb343000f14a1072e99b0df1
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected7e370545b8bdb54ed7f1ae485d6d24d3b62a0b53
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.6.92Fixed6.6.145
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.12.30Fixed6.12.96
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.14.8Fixed6.15
Affected versions
v2.*
v3.*
v4.*
v5.*
v6.*
Linux / Kernel
Package
- Name
- Kernel