In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix urb->setup_packet leak in error paths The setup_packet of… (CVE-2026-64144)
A vulnerability in the Linux kernel Bluetooth driver (btmtk) involved a memory leak where the setup_packet of a control urb was not freed if usb_submit_urb failed or if the urb was killed. This issue has been resolved by adding the necessary free operations in these error paths.
AI Analysis
Technical Summary
The Linux kernel Bluetooth driver btmtk had a resource management flaw where the setup_packet associated with a control urb was leaked in error conditions, specifically when usb_submit_urb failed or when the urb was killed. This could lead to memory leaks affecting system stability or resource exhaustion. The vulnerability has been fixed by ensuring the setup_packet is freed in these error paths.
Potential Impact
The vulnerability causes a memory leak in the Bluetooth driver, which could degrade system performance or stability over time due to unreleased memory. There is no indication of direct code execution or privilege escalation from the provided data.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by freeing the setup_packet in all error paths. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the input; check the vendor advisory or Linux kernel release notes for the exact fixed versions and update accordingly.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix urb->setup_packet leak in error paths The setup_packet of… (CVE-2026-64144)
Description
A vulnerability in the Linux kernel Bluetooth driver (btmtk) involved a memory leak where the setup_packet of a control urb was not freed if usb_submit_urb failed or if the urb was killed. This issue has been resolved by adding the necessary free operations in these error paths.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel Bluetooth driver btmtk had a resource management flaw where the setup_packet associated with a control urb was leaked in error conditions, specifically when usb_submit_urb failed or when the urb was killed. This could lead to memory leaks affecting system stability or resource exhaustion. The vulnerability has been fixed by ensuring the setup_packet is freed in these error paths.
Potential Impact
The vulnerability causes a memory leak in the Bluetooth driver, which could degrade system performance or stability over time due to unreleased memory. There is no indication of direct code execution or privilege escalation from the provided data.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by freeing the setup_packet in all error paths. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the input; check the vendor advisory or Linux kernel release notes for the exact fixed versions and update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-wh4m-6pmv-mq2m
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64144"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a82a4a8d598912a8aa
Added to database: 07/19/2026, 19:38:16 UTC
Last enriched: 07/19/2026, 19:43:11 UTC
Last updated: 07/20/2026, 07:57:50 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.