Not yet scoredPublished Jul 25, 2026

CVE-2026-64471Bluetooth: btusb: fix use-after-free on registration failure

Updated under an hour ago (Oct 28, 2026, 4:50 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on registration failure Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected. This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 9bfa35fe422c74882e27cc54450a5f76c96aad68 before e09ac7d0c6859a360bf36e7104aef03f88184e0b; from 9bfa35fe422c74882e27cc54450a5f76c96aad68 before 468fcdfaeb937163dd250773a9fed17ab1fa203c; 9bfa35fe422c74882e27cc54450a5f76c96aad68 builds before 1ce5012944afaddbda939ec6bae9800fce84abbc; from 9bfa35fe422c74882e27cc54450a5f76c96aad68 before e6313b800da61a26c2fdd5eba0105e197c0ab3bc; from 9bfa35fe422c74882e27cc54450a5f76c96aad68 before 14e02f1449ba425a44dedbec9a21efafb056e09f; 9bfa35fe422c74882e27cc54450a5f76c96aad68 builds before 8db0ce3de78367f61c2970c0f16d9adee8830a23; from 9bfa35fe422c74882e27cc54450a5f76c96aad68 before da7d7758fe884b256ddc9fef562e5ddef7952383; from 9bfa35fe422c74882e27cc54450a5f76c96aad68 before eedc6867ebad73edbfaf9a0a65fbef7115cc4753	CNA record

References

References

https://git.kernel.org/stable/c/e09ac7d0c6859a360bf36e7104aef03f88184e0b
https://git.kernel.org/stable/c/468fcdfaeb937163dd250773a9fed17ab1fa203c
https://git.kernel.org/stable/c/1ce5012944afaddbda939ec6bae9800fce84abbc
https://git.kernel.org/stable/c/e6313b800da61a26c2fdd5eba0105e197c0ab3bc
https://git.kernel.org/stable/c/14e02f1449ba425a44dedbec9a21efafb056e09f
https://git.kernel.org/stable/c/8db0ce3de78367f61c2970c0f16d9adee8830a23
https://git.kernel.org/stable/c/da7d7758fe884b256ddc9fef562e5ddef7952383
https://git.kernel.org/stable/c/eedc6867ebad73edbfaf9a0a65fbef7115cc4753

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.