CVE-2026-64406
Estado: AnalizadaAlta (8)—
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix UAF in bt_accept_dequeue()
bt_accept_get() takes a temporary reference before dropping the accept queue lock. bt_accept_dequeue() currently drops that reference before bt_accept_unlink(), leaving only the queue reference.
bt_accept_unlink() drops the queue reference. The subsequent sock_hold() therefore accesses freed memory if it was the final reference, as observed by KASAN during listening L2CAP socket cleanup.
Retain the temporary queue-walk reference through unlink and hand it to the caller on success. Drop it explicitly on the closed and not-yet-connected paths.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.43%
- Percentil entre todas las CVEs puntuadas: 35
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1210Exploitation of Remote Serviceslateral movement45 % - Impacto principal
T1059Command and Scripting Interpreterexecution35 %
AV:A/PR:L indica acceso local/red adyacente con privilegios; UAF en kernel Bluetooth podría permitir ejecución de código, aunque la vulnerabilidad es principalmente de seguridad de memoria sin evidencia explícita de RCE remota.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
CWE
- CWE-416
Referencias
- https://git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0
- https://git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614
- https://git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9a
- https://git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049
- https://git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1db
- https://git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547
- https://git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8d
- https://git.kernel.org/stable/c/c66a95e60b65d876a927123b0ed36bd6177d9ca6
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-64406",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.1
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "751de6ec671fe75ad9cf65a0638d2a06b6a5984d",
"lessThan": "c0577c55219be42b6ea2ea8db11e85bfab6f4e8d",
"versionType": "git"
},
{
"status": "affected",
"version": "407217734835d21d4e0105ebf347860dc1806f88",
"lessThan": "96ad400d5132eb333f28f6f1e2d58f0728ca9547",
"versionType": "git"
},
{
"status": "affected",
"version": "7eebd4c2c86f573af87ff165d08a83432eb0b919",
"lessThan": "0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0",
"versionType": "git"
},
{
"status": "affected",
"version": "5d86d2f1b4d9a508c441d3e45277ae1a73cfed57",
"lessThan": "c66a95e60b65d876a927123b0ed36bd6177d9ca6",
"versionType": "git"
},
{
"status": "affected",
"version": "87c543e2f78d0871f271df92dab98901bbd5b6f5",
"lessThan": "6303ed4bbe0095f4cc195225479bf506e010d1db",
"versionType": "git"
},
{
"status": "affected",
"version": "added1213395071470a900cc845a042fb51882a6",
"lessThan": "26168db1ce5a9766cde021b18e590a101c056614",
"versionType": "git"
},
{
"status": "affected",
"version": "ab1513597c6cf17cd1ad2a21e3b045421b48e022",
"lessThan": "50c662bdcd51b03033a0abed6716bfd377ba1049",
"versionType": "git"
},
{
"status": "affected",
"version": "ab1513597c6cf17cd1ad2a21e3b045421b48e022",
"lessThan": "4bd0b274054f2679f28b70222b607bb0afc3ab9a",
"versionType": "git"
},
{
"status": "affected",
"version": "a5ca86a6097a8b030ca3226cd300b17ed330f966",
"versionType": "git"
},
{
"status": "affected",
"version": "5.10.259",
"lessThan": "5.10.261",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.210",
"lessThan": "5.15.212",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.175",
"lessThan": "6.1.178",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.142",
"lessThan": "6.6.145",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.92",
"lessThan": "6.12.96",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.18.34",
"lessThan": "6.18.39",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.0.11",
"lessThan": "7.1",
"versionType": "semver"
}
],
"programFiles": [
"net/bluetooth/af_bluetooth.c",
"net/bluetooth/l2cap_sock.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "7.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/bluetooth/af_bluetooth.c",
"net/bluetooth/l2cap_sock.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-07-25T10:17:24.243",
"references": [
{
"url": "https://git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9a",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1db",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8d",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c66a95e60b65d876a927123b0ed36bd6177d9ca6",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix UAF in bt_accept_dequeue()\n\nbt_accept_get() takes a temporary reference before dropping the accept\nqueue lock. bt_accept_dequeue() currently drops that reference before\nbt_accept_unlink(), leaving only the queue reference.\n\nbt_accept_unlink() drops the queue reference. The subsequent\nsock_hold() therefore accesses freed memory if it was the final\nreference, as observed by KASAN during listening L2CAP socket cleanup.\n\nRetain the temporary queue-walk reference through unlink and hand it to\nthe caller on success. Drop it explicitly on the closed and\nnot-yet-connected paths."
}
],
"lastModified": "2026-09-04T15:30:13.627",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "429937D6-6F74-403A-B60A-AA311A9FA3AB",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.259"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "42434AE1-4361-420E-AC94-62114ADF9A54",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.210"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6476CFBE-7300-465C-8DBA-620D3D005F5A",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.175"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D144D922-9AD2-409A-85E8-D8620FC3CA68",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.142"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BDFE208F-4818-458A-AFBE-4ADB1689BDAF",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.12.92"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A1CDB605-6051-43A2-A590-8940B9A47D45",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.18.34"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F099E30C-99C7-4E28-BFFA-57D8DCD36E9B",
"versionEndExcluding": "7.1",
"versionStartIncluding": "7.0.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E69D5CC8-02A4-44DA-A9D9-12B8E0C6AF08",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "7.1.1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "42591D75-4648-4AF0-B193-8AE633EFFACF"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1039E95A-8CC3-4C88-8FF9-5C08EEB861C9"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}