In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev->name bnep_add_connection() needs to keep… (CVE-2026-64178)

The Linux kernel Bluetooth bnep subsystem had a use-after-free vulnerability (CVE-2026-64178) caused by bnep_add_connection() not holding the bnep_session_sem lock while reading dev->name, allowing a concurrent bnep_session() thread to free the net_device during a race condition triggered by bnep_del_connection(). Exploitation requires CAP_NET_ADMIN capability and a tight race window, making it less severe. The issue is fixed in Linux kernel updates. The vendor advisory from Ubuntu confirms patches are available and recommends updating and rebooting. The advisory also covers numerous other Linux kernel vulnerabilities fixed in the same update cycle.

The vulnerability allows a local attacker with CAP_NET_ADMIN privileges to trigger a use-after-free read, potentially leading to information disclosure or system instability. However, the required privileges and race conditions limit the practical impact. The CVSS score is 8.8, indicating high severity, but the vendor rates it medium due to exploitation complexity and privilege requirements. No known exploits are reported in the wild.

A patch is available from the Linux kernel maintainers and Ubuntu. Users should update their Linux kernel packages to the fixed versions and reboot their systems to apply the changes. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled after the update. No additional mitigations are required beyond applying the official fixes.