---
id: CVE-2026-64144
title: 'Bluetooth: btmtk: fix urb->setup_packet leak in error paths'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: btmtk: fix urb->setup_packet leak in error paths

  The setup_packet of control urb is not freed if usb_submit_urb fails or
  the submitted urb is killed. Add fr…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a1c49c434e15050b5dafe3b6f5cc732d4f02d657 <
    ecd8d2531766641958a667829907204066cfb51a
  - >-
    Linux >= a1c49c434e15050b5dafe3b6f5cc732d4f02d657 <
    2a1905730e0c771b999906a7b509722f795563c6
  - >-
    Linux >= a1c49c434e15050b5dafe3b6f5cc732d4f02d657 <
    68c027c2003b0a8a1439d0301c59c6fd1eb3b844
  - >-
    Linux >= a1c49c434e15050b5dafe3b6f5cc732d4f02d657 <
    a0f5268c77eb73f84ba7c210ddfc54b1c73ff80c
  - >-
    Linux >= a1c49c434e15050b5dafe3b6f5cc732d4f02d657 <
    0d2572bafea33c7cd1d77c6a25f25ff31a432482
  - >-
    Linux >= a1c49c434e15050b5dafe3b6f5cc732d4f02d657 <
    dd1dda6b8d6e1f4376a5b3055a04f0ecbdb4d6bd
  - Linux 5.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:30:35.804518Z'
published: '2026-07-19'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:34:27.066Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64144'
references:
  - url: 'https://git.kernel.org/stable/c/ecd8d2531766641958a667829907204066cfb51a'
  - url: 'https://git.kernel.org/stable/c/2a1905730e0c771b999906a7b509722f795563c6'
  - url: 'https://git.kernel.org/stable/c/68c027c2003b0a8a1439d0301c59c6fd1eb3b844'
  - url: 'https://git.kernel.org/stable/c/a0f5268c77eb73f84ba7c210ddfc54b1c73ff80c'
  - url: 'https://git.kernel.org/stable/c/0d2572bafea33c7cd1d77c6a25f25ff31a432482'
  - url: 'https://git.kernel.org/stable/c/dd1dda6b8d6e1f4376a5b3055a04f0ecbdb4d6bd'
tags:
  - cve.org
epss: 0.00128
epssPercentile: 0.02475
ingestedAt: '2026-11-05T15:02:32.415Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btmtk: fix urb->setup_packet leak in error paths

The setup_packet of control urb is not freed if usb_submit_urb fails or
the submitted urb is killed. Add free in these two paths.

## Affected

- `Linux >= a1c49c434e15050b5dafe3b6f5cc732d4f02d657 < ecd8d2531766641958a667829907204066cfb51a`
- `Linux >= a1c49c434e15050b5dafe3b6f5cc732d4f02d657 < 2a1905730e0c771b999906a7b509722f795563c6`
- `Linux >= a1c49c434e15050b5dafe3b6f5cc732d4f02d657 < 68c027c2003b0a8a1439d0301c59c6fd1eb3b844`
- `Linux >= a1c49c434e15050b5dafe3b6f5cc732d4f02d657 < a0f5268c77eb73f84ba7c210ddfc54b1c73ff80c`
- `Linux >= a1c49c434e15050b5dafe3b6f5cc732d4f02d657 < 0d2572bafea33c7cd1d77c6a25f25ff31a432482`
- `Linux >= a1c49c434e15050b5dafe3b6f5cc732d4f02d657 < dd1dda6b8d6e1f4376a5b3055a04f0ecbdb4d6bd`
- `Linux 5.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.