CVE-2026-64470 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btusb: fix use-after-free on marvell probe failure
Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion callback.
This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability in question represents a critical use-after-free condition within the Linux kernel's Bluetooth subsystem specifically affecting the btusb driver when handling Marvell chipset probes. This flaw occurs during the device initialization process where the driver attempts to configure Out-of-Band wakeup functionality for Marvell Bluetooth chips. The technical implementation involves the management of USB Request Blocks (URBs) that are submitted during the probe sequence, with the completion callback handler executing after a failed probe attempt. The root cause stems from insufficient cleanup procedures when probe failures occur after URB submission but before successful device initialization, creating a scenario where memory allocated for URB structures may be freed while still referenced by pending completion callbacks. This condition falls under the CWE-416 vulnerability category, specifically addressing use-after-free errors in kernel space memory management operations.
The operational impact of this vulnerability extends beyond simple system stability concerns to potentially enable privilege escalation and denial-of-service conditions within kernel contexts. When a Marvell Bluetooth device probe fails during the wakeup configuration phase, the driver must properly terminate any pending transmission URBs that were submitted during the configuration process. The absence of proper cleanup mechanisms means these URB structures can be freed from memory while their completion callbacks are still scheduled to execute, leading to potential memory corruption or arbitrary code execution if attackers can manipulate the freed memory contents. This vulnerability directly relates to ATT&CK technique T1068 which involves exploiting local privileges to gain elevated system access through kernel-level flaws. The issue becomes particularly concerning in embedded systems and IoT devices where Bluetooth connectivity is prevalent and kernel memory management errors can be exploited for persistent system compromise.
The recommended mitigation strategies involve implementing proper URB cancellation and cleanup procedures within the btusb driver error handling paths, specifically ensuring that any pending TX URBs are explicitly terminated before freeing associated memory structures during probe failure scenarios. System administrators should ensure kernel updates are applied to address this vulnerability, particularly in environments where Bluetooth devices are actively used with Marvell chipsets. The fix requires careful synchronization between the device probe completion logic and URB management subsystems, implementing proper reference counting and state tracking mechanisms to prevent premature memory deallocation while maintaining system responsiveness. Organizations should also implement monitoring for unusual Bluetooth device behavior or kernel panic events that may indicate exploitation attempts targeting this class of vulnerability, as the use-after-free condition can manifest in various ways depending on memory layout and timing factors during concurrent system operations.