CVE-2026-64433: Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1 - Configuration
Fix the Bluetooth UAF by holding hci_dev_lock() across hci_conn_params_lookup() and across the read/dereference of the returned hci_conn_params object in add_device_complete() (net/bluetooth/mgmt.c), preventing concurrent MGMT_OP_REMOVE_DEVICE from freeing hci_conn_params before use.
Linux kernel Bluetooth mgmt.c Hold hci_dev_lock() across hci_conn_params_lookup() and the subsequent dereference of lookup result (e.g., reading cp->addr.type and params->flags) = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64433?
CVE-2026-64433 has a medium severity score of 5.5.
How do I fix CVE-2026-64433?
To fix CVE-2026-64433, update to the latest Linux kernel version where this vulnerability has been patched.
What type of vulnerability is CVE-2026-64433?
CVE-2026-64433 is classified as a Use After Free vulnerability.
Which systems are affected by CVE-2026-64433?
CVE-2026-64433 affects the Linux kernel and Microsoft azl3 kernel 6.6.144.1-1.
What does CVE-2026-64433 involve?
CVE-2026-64433 involves a use-after-free vulnerability in the hci_conn_params during the add_device_complete function in the Bluetooth management.