CVE-2026-64144 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btmtk: fix urb->setup_packet leak in error paths
The setup_packet of control urb is not freed if usb_submit_urb fails or the submitted urb is killed. Add free in these two paths.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability resides within the linux kernel's bluetooth subsystem specifically affecting the btmtk driver which handles bluetooth devices usingmediatek chipsets. The issue represents a memory leak condition that occurs during error handling pathways when processing usb control requests. The flaw manifests when the usb_submit_urb function fails or when a submitted urb is terminated, leaving the setup_packet memory allocated without proper cleanup. This represents a classic resource management failure where allocated kernel memory is not properly released during exceptional code paths.
The technical implementation involves the btmtk driver's handling of usb control transfer requests through the usb subsystem. When a control urb (usb request block) is prepared for submission, it contains a setup_packet field that holds the usb setup data structure. Under normal operation, this memory is properly managed through the usb core's completion handlers. However, when errors occur during submission or when the urb is explicitly killed by the system, the driver fails to invoke proper cleanup routines that would free the setup_packet memory allocation.
From a cybersecurity perspective, this vulnerability falls under CWE-401: Improper Release of Memory and aligns with ATT&CK technique T1059.006: Command and Scripting Interpreter - PowerShell, though more directly related to resource exhaustion attacks. The memory leak could potentially be exploited in denial of service scenarios where repeated error conditions cause progressive memory consumption within the kernel space. While the immediate impact appears limited to memory allocation leakage rather than arbitrary code execution, sustained exploitation could lead to system instability or reduced performance in systems handling high volumes of bluetooth communications.
The operational impact affects any linux system running with btmtk driver enabled and connected to mediatek-based bluetooth hardware. Systems that frequently experience usb communication errors or perform high frequency bluetooth device operations would be most susceptible to memory exhaustion over time. The vulnerability is particularly concerning in embedded systems or devices where memory resources are constrained and where continuous bluetooth connectivity is required.
Mitigation strategies include applying the kernel patch that adds proper free() calls in both error paths where usb_submit_urb fails and when submitted urbs are killed. System administrators should prioritize updating to kernel versions containing this fix, particularly on systems with active bluetooth operations. Monitoring for memory usage patterns in kernel space can help detect potential exploitation attempts, though the vulnerability itself is more of a resource consumption issue than an active security threat. The fix demonstrates proper defensive programming practices by ensuring all allocated resources are freed regardless of execution path taken during error handling scenarios.