CVE-2026-64144: Bluetooth: btmtk: fix urb->setup_packet leak in error paths

Q: What is the severity of CVE-2026-64144?

The severity of CVE-2026-64144 is rated at 10, indicating a critical risk level.

Q: How do I fix CVE-2026-64144?

To fix CVE-2026-64144, ensure that the Linux kernel is updated to the version that includes the patches resolving this vulnerability.

Q: What systems are affected by CVE-2026-64144?

CVE-2026-64144 affects the Bluetooth subsystem within the Linux kernel.

Q: What type of vulnerability is CVE-2026-64144?

CVE-2026-64144 is a memory management vulnerability specifically related to resource leaks.

Q: When was CVE-2026-64144 published?

CVE-2026-64144 was published on July 19, 2026.

Published Jul 19, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btmtk: fix urb->setuppacket leak in error paths

The setuppacket of control urb is not freed if usbsubmiturb fails or the submitted urb is killed. Add free in these two paths.

Affected Software

243 affected componentsFixes available

Linux Linux kernel

Linux Linux kernel>=5.3<6.6.142

Linux Linux kernel>=6.7<6.12.92

Linux Linux kernel>=6.13<6.18.34

Linux Linux kernel>=6.19<7.0.11

Linux Linux kernel=7.1-rc1

Linux Linux kernel=7.1-rc2

Linux Linux kernel=7.1-rc3

Linux Linux kernel=7.1-rc4

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4*

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4*

ubuntu/linux-raspi-5.4*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15*

ubuntu/linux-bluefield*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15*

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm*

ubuntu/linux-ibm-5.15*

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15*

ubuntu/linux-iot*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency-hwe-5.15*

ubuntu/linux-nvidia-tegra-5.15*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15*

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1064.67~22.04.1

6.8.0-1064.67~22.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1067.75~22.04.1

6.8.0-1067.75~22.04.1

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1065.72~22.04.1

6.8.0-1065.72~22.04.1

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1067.75~22.04.1

6.8.0-1067.75~22.04.1

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm*

ubuntu/linux-ibm-6.8<6.8.0-1066.67~22.04.1

6.8.0-1066.67~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-139.139.1~22.04.1

6.8.0-139.139.1~22.04.1

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1062.65~22.04.1

6.8.0-1062.65~22.04.1

ubuntu/linux-nvidia-tegra*

ubuntu/linux-nvidia-tegra-igx*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1061.64~22.04.1

6.8.0-1061.64~22.04.1

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-139.139~22.04.1

6.8.0-139.139~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-bluefield*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-realtime-6.8<6.8.1-1059.60~22.04.1

6.8.1-1059.60~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<6.8.0-139.139

6.8.0-139.139

ubuntu/linux-aws<6.8.0-1064.67

6.8.0-1064.67

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-azure<6.8.0-1067.75

6.8.0-1067.75

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-azure-fde<6.8.0-1065.72

6.8.0-1065.72

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0<7.0.0-1013.13~24.04.1

7.0.0-1013.13~24.04.1

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1067.75

6.8.0-1067.75

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0<7.0.0-1011.11~24.04.1

7.0.0-1011.11~24.04.1

ubuntu/linux-gke<6.8.0-1062.70

6.8.0-1062.70

ubuntu/linux-gkeop<6.8.0-1049.53

6.8.0-1049.53

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-hwe-7.0<7.0.0-28.28~24.04.1

7.0.0-28.28~24.04.1

ubuntu/linux-ibm<6.8.0-1064.65

6.8.0-1064.65

ubuntu/linux-lowlatency<6.8.0-139.139.1

6.8.0-139.139.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1062.65

6.8.0-1062.65

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-7.0<7.0.0-1016.16~24.04.1

7.0.0-1016.16~24.04.1

ubuntu/linux-nvidia-lowlatency<6.8.0-1062.65.1

6.8.0-1062.65.1

ubuntu/linux-nvidia-tegra<6.8.0-1035.38

6.8.0-1035.38

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1061.64

6.8.0-1061.64

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0<7.0.0-1011.11~24.04.1

7.0.0-1011.11~24.04.1

ubuntu/linux-raspi<6.8.0-1064.68

6.8.0-1064.68

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-28.28.1~24.04.3

7.0.0-28.28.1~24.04.3

ubuntu/linux-xilinx<6.8.0-1036.37

6.8.0-1036.37

ubuntu/linux-bluefield<6.8.0-1030.35

6.8.0-1030.35

ubuntu/linux-raspi-realtime<6.8.0-2053.55

6.8.0-2053.55

ubuntu/linux-realtime<6.8.1-1059.60

6.8.1-1059.60

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux-aws-fips<6.8.0-1064.67+fips1

6.8.0-1064.67+fips1

ubuntu/linux-azure-fips<6.8.0-1067.75+fips1

6.8.0-1067.75+fips1

ubuntu/linux-fips<6.8.0-139.139+fips1

6.8.0-139.139+fips1

ubuntu/linux-gcp-fips<6.8.0-1067.75+fips1

6.8.0-1067.75+fips1

ubuntu/linux<7.0.0-28.28

7.0.0-28.28

ubuntu/linux-aws<7.0.0-1009.9

7.0.0-1009.9

ubuntu/linux-azure<7.0.0-1010.10

7.0.0-1010.10

ubuntu/linux-azure-fde<7.0.0-1009.9

7.0.0-1009.9

ubuntu/linux-gcp<7.0.0-1008.8

7.0.0-1008.8

ubuntu/linux-gke<7.0.0-1003.4

7.0.0-1003.4

ubuntu/linux-ibm<7.0.0-1010.10

7.0.0-1010.10

ubuntu/linux-nvidia<7.0.0-1016.16

7.0.0-1016.16

ubuntu/linux-nvidia-bos<7.0.0-2016.16

7.0.0-2016.16

ubuntu/linux-oem-7.0<7.0.0-1009.9

7.0.0-1009.9

ubuntu/linux-oracle<7.0.0-1008.8

7.0.0-1008.8

ubuntu/linux-raspi<7.0.0-1015.15

7.0.0-1015.15

ubuntu/linux-realtime<7.0.0-28.28.1

7.0.0-28.28.1

ubuntu/linux-riscv<7.0.0-28.28.1

7.0.0-28.28.1

debian/linux*

debian/linux<6.12.94-1

6.12.94-1

debian/linux<7.0.12-1

7.0.12-1

linux/kernel>=5.3.0<6.1.191

6.1.191

linux/kernel>=6.2.0<6.6.142

6.6.142

linux/kernel>=6.7.0<6.12.92

6.12.92

linux/kernel>=6.13.0<6.18.34

6.18.34

linux/kernel>=6.19.0<7.0.11

7.0.11

debian/linux<=6.1.176-1, <=6.1.190-1

6.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.67~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.75~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1065.72~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.75~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1066.67~22.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-139.139.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.65~22.04.1
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.64~22.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-139.139~22.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1059.60~22.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-139.139
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.67
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.75
Upgrade
Upgrade ubuntu/linux-azure-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1065.72
Upgrade
Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.75
Upgrade
Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1011.11~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.70
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.53
Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-28.28~24.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.65
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-139.139.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.65
Upgrade
Upgrade ubuntu/linux-nvidia-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16~24.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.65.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1035.38
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.64
Upgrade
Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1011.11~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.68
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-28.28.1~24.04.3
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1036.37
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1030.35
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2053.55
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1059.60
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.67+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.75+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-139.139+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.75+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-28.28
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1009.9
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 7.0.0-1010.10
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 7.0.0-1009.9
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1008.8
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 7.0.0-1003.4
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1010.10
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16
Upgrade
Upgrade ubuntu/linux-nvidia-bos to a version that resolves this vulnerability.
Fixed in 7.0.0-2016.16
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1009.9
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1008.8
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.15
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 7.0.0-28.28.1
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-28.28.1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.12.94-1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 7.0.12-1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 6.1.191
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 6.6.142
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 6.12.92
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 6.18.34
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 7.0.11

Event History

Jul 19, 2026

CVE Published

via MITRE·03:40 PM

Data Sourced

via MITRE·03:40 PM

Description

Data Sourced

via OSV·03:40 PM

DescriptionAffected Software

Data Sourced

via NVD·04:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·04:17 PM

Severity

Frequently Asked Questions

What is the severity of CVE-2026-64144?

The severity of CVE-2026-64144 is rated at 10, indicating a critical risk level.

How do I fix CVE-2026-64144?

To fix CVE-2026-64144, ensure that the Linux kernel is updated to the version that includes the patches resolving this vulnerability.

What systems are affected by CVE-2026-64144?

CVE-2026-64144 affects the Bluetooth subsystem within the Linux kernel.

What type of vulnerability is CVE-2026-64144?

CVE-2026-64144 is a memory management vulnerability specifically related to resource leaks.

When was CVE-2026-64144 published?

CVE-2026-64144 was published on July 19, 2026.

CVE-2026-64144: Bluetooth: btmtk: fix urb->setup_packet leak in error paths

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2026-64144?

How do I fix CVE-2026-64144?

What systems are affected by CVE-2026-64144?

What type of vulnerability is CVE-2026-64144?

When was CVE-2026-64144 published?

Company

Resources

Contact