CVE-2026-64405

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A null pointer dereference exists in the Bluetooth component. The hci abort conn() function reads hci skb event(hdev->sent cmd) during a pending connection; however, hdev->sent cmd can be NULL while req status remains HCI REQ PEND. This leads to a general protection fault within the hci rx work() receive path. Additionally, a use-after-free condition could occur if the command status handler frees the connection via hci conn del() while the worker is blocked on the connection complete event.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.