CVE-2026-64178 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: bnep: Fix UAF read of dev->name
bnep_add_connection() needs to keep holding the bnep_session_sem while reading dev->name (just like bnep_get_connlist() does); otherwise the bnep_session() thread can concurrently free the net_device, which can for example be triggered by a concurrent bnep_del_connection().
(This UAF is fairly uninteresting from a security perspective; calling bnep_add_connection() requires passing a capable(CAP_NET_ADMIN) check. It also requires completely tearing down a netdev during a fairly tight race window.)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability identified in the Linux kernel's Bluetooth networking implementation represents a use-after-free condition within the BNEP (Bluetooth Network Encapsulation Protocol) subsystem. This flaw manifests in the bnep_add_connection() function where improper synchronization leads to potential memory corruption scenarios. The core issue arises from insufficient semaphore management during critical operations involving network device access, specifically when reading the dev->name field of a net_device structure.
The technical flaw stems from the fact that bnep_add_connection() fails to maintain exclusive access to the bnep_session_sem lock while performing reads on the dev->name field. This contrasts with the proper implementation in bnep_get_connlist() which correctly holds the semaphore throughout the read operation. The race condition occurs when a concurrent bnep_del_connection() call executes simultaneously, potentially leading to the net_device structure being freed while another thread attempts to access its name field. This creates a classic use-after-free scenario where memory previously allocated to a device structure may have been deallocated and repurposed, yet still accessed by the reading thread.
From an operational perspective, this vulnerability demonstrates the importance of proper synchronization in multi-threaded kernel subsystems where concurrent operations can lead to memory corruption. The exploitability assessment reveals that while this particular UAF does not present significant security implications, it still represents a legitimate stability concern within the kernel's Bluetooth networking stack. The requirement for CAP_NET_ADMIN capability means that exploitation would need elevated privileges, limiting its practical impact to scenarios involving compromised administrative accounts or privilege escalation attempts.
The vulnerability aligns with CWE-416, which describes use-after-free conditions in software systems, and while it does not directly map to specific ATT&CK tactics, it represents a foundational stability issue that could potentially be leveraged as part of broader exploitation chains. The fix implemented addresses the synchronization gap by ensuring consistent semaphore usage across all functions that access the net_device name field, thereby preventing concurrent access patterns that could lead to memory corruption.
This remediation approach follows established kernel development practices for managing shared resources in concurrent environments, emphasizing the critical need for consistent locking mechanisms when accessing structures that may be concurrently modified or freed. The fix ensures that all read operations on device name fields maintain proper synchronization with write operations, preventing scenarios where freed memory might be accessed after deallocation. Such improvements contribute to overall kernel stability and prevent potential denial-of-service conditions or more serious corruption scenarios that could affect system integrity.
The resolution of this vulnerability demonstrates the ongoing importance of thorough code review and testing in kernel subsystems, particularly those handling network communications where race conditions can have significant operational impacts. Proper synchronization mechanisms are essential for preventing memory safety issues in concurrent systems, and this fix reinforces best practices for managing shared resources in multi-threaded kernel environments where timing-sensitive operations must maintain data consistency across all access paths.