CVE-2026-64433

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free (UAF) issue exists in the Bluetooth MGMT component. The add device complete() function, executing from the hci cmd sync work kworker, calls hci conn params lookup() and dereferences the params->flags variable without holding the required hci dev lock. A concurrent remove device() operation, which runs under hci dev lock, can call hci conn params free() to delete and free the object returned by the lookup. This results in the add device complete() function accessing freed memory when reading params->flags.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.