---
id: CVE-2026-64471
title: 'Bluetooth: btusb: fix use-after-free on registration failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: btusb: fix use-after-free on registration failure

  Make sure to release the sibling interfaces in case controller
  registration fails to avoid use-after-free …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9bfa35fe422c74882e27cc54450a5f76c96aad68 <
    e09ac7d0c6859a360bf36e7104aef03f88184e0b
  - >-
    Linux >= 9bfa35fe422c74882e27cc54450a5f76c96aad68 <
    468fcdfaeb937163dd250773a9fed17ab1fa203c
  - >-
    Linux >= 9bfa35fe422c74882e27cc54450a5f76c96aad68 <
    1ce5012944afaddbda939ec6bae9800fce84abbc
  - >-
    Linux >= 9bfa35fe422c74882e27cc54450a5f76c96aad68 <
    e6313b800da61a26c2fdd5eba0105e197c0ab3bc
  - >-
    Linux >= 9bfa35fe422c74882e27cc54450a5f76c96aad68 <
    14e02f1449ba425a44dedbec9a21efafb056e09f
  - >-
    Linux >= 9bfa35fe422c74882e27cc54450a5f76c96aad68 <
    8db0ce3de78367f61c2970c0f16d9adee8830a23
  - >-
    Linux >= 9bfa35fe422c74882e27cc54450a5f76c96aad68 <
    da7d7758fe884b256ddc9fef562e5ddef7952383
  - >-
    Linux >= 9bfa35fe422c74882e27cc54450a5f76c96aad68 <
    eedc6867ebad73edbfaf9a0a65fbef7115cc4753
  - Linux 2.6.27
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:39:22.520921Z'
published: '2026-07-25'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:44:53.352Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64471'
references:
  - url: 'https://git.kernel.org/stable/c/e09ac7d0c6859a360bf36e7104aef03f88184e0b'
  - url: 'https://git.kernel.org/stable/c/468fcdfaeb937163dd250773a9fed17ab1fa203c'
  - url: 'https://git.kernel.org/stable/c/1ce5012944afaddbda939ec6bae9800fce84abbc'
  - url: 'https://git.kernel.org/stable/c/e6313b800da61a26c2fdd5eba0105e197c0ab3bc'
  - url: 'https://git.kernel.org/stable/c/14e02f1449ba425a44dedbec9a21efafb056e09f'
  - url: 'https://git.kernel.org/stable/c/8db0ce3de78367f61c2970c0f16d9adee8830a23'
  - url: 'https://git.kernel.org/stable/c/da7d7758fe884b256ddc9fef562e5ddef7952383'
  - url: 'https://git.kernel.org/stable/c/eedc6867ebad73edbfaf9a0a65fbef7115cc4753'
tags:
  - cve.org
epss: 0.00184
epssPercentile: 0.08081
ingestedAt: '2026-11-06T16:57:43.169Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: fix use-after-free on registration failure

Make sure to release the sibling interfaces in case controller
registration fails to avoid use-after-free and double-free when they are
eventually disconnected.

This issue was reported by Sashiko while reviewing a fix for a wakeup
source leak in the btusb probe errors paths.

## Affected

- `Linux >= 9bfa35fe422c74882e27cc54450a5f76c96aad68 < e09ac7d0c6859a360bf36e7104aef03f88184e0b`
- `Linux >= 9bfa35fe422c74882e27cc54450a5f76c96aad68 < 468fcdfaeb937163dd250773a9fed17ab1fa203c`
- `Linux >= 9bfa35fe422c74882e27cc54450a5f76c96aad68 < 1ce5012944afaddbda939ec6bae9800fce84abbc`
- `Linux >= 9bfa35fe422c74882e27cc54450a5f76c96aad68 < e6313b800da61a26c2fdd5eba0105e197c0ab3bc`
- `Linux >= 9bfa35fe422c74882e27cc54450a5f76c96aad68 < 14e02f1449ba425a44dedbec9a21efafb056e09f`
- `Linux >= 9bfa35fe422c74882e27cc54450a5f76c96aad68 < 8db0ce3de78367f61c2970c0f16d9adee8830a23`
- `Linux >= 9bfa35fe422c74882e27cc54450a5f76c96aad68 < da7d7758fe884b256ddc9fef562e5ddef7952383`
- `Linux >= 9bfa35fe422c74882e27cc54450a5f76c96aad68 < eedc6867ebad73edbfaf9a0a65fbef7115cc4753`
- `Linux 2.6.27`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.