CyberSecBulletin
CVE-2026-64406NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-64406 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 8.0 out of 10. It can be exploited from the same local network by an attacker with a low-privileged account, without any action from a user. The record lists versions c0577c55219be42b6ea2ea8db11e85bfab6f4e8d, 96ad400d5132eb333f28f6f1e2d58f0728ca9547, 0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.27% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to c0577c55219be42b6ea2ea8db11e85bfab6f4e8d or 96ad400d5132eb333f28f6f1e2d58f0728ca9547 or 0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0 or c66a95e60b65d876a927123b0ed36bd6177d9ca6, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.261 or 5.15.212 or 6.1.178 or 6.6.145, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux751de6ec671fe75ad9cf65a0638d2a06b6a5984d up to, but not including, c0577c55219be42b6ea2ea8db11e85bfab6f4e8d; 407217734835d21d4e0105ebf347860dc1806f88 up to, but not including, 96ad400d5132eb333f28f6f1e2d58f0728ca9547; 7eebd4c2c86f573af87ff165d08a83432eb0b919 up to, but not including, 0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0; 5d86d2f1b4d9a508c441d3e45277ae1a73cfed57 up to, but not including, c66a95e60b65d876a927123b0ed36bd6177d9ca6; 87c543e2f78d0871f271df92dab98901bbd5b6f5 up to, but not including, 6303ed4bbe0095f4cc195225479bf506e010d1db; added1213395071470a900cc845a042fb51882a6 up to, but not including, 26168db1ce5a9766cde021b18e590a101c056614; ab1513597c6cf17cd1ad2a21e3b045421b48e022 up to, but not including, 50c662bdcd51b03033a0abed6716bfd377ba1049; ab1513597c6cf17cd1ad2a21e3b045421b48e022 up to, but not including, 4bd0b274054f2679f28b70222b607bb0afc3ab9a; and 9 more rangesc0577c55219be42b6ea2ea8db11e85bfab6f4e8d, 96ad400d5132eb333f28f6f1e2d58f0728ca9547, 0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0, c66a95e60b65d876a927123b0ed36bd6177d9ca6, 6303ed4bbe0095f4cc195225479bf506e010d1db, 26168db1ce5a9766cde021b18e590a101c056614
LinuxLinux Kernel5.10.259 up to, but not including, 5.10.261; 5.15.210 up to, but not including, 5.15.212; 6.1.175 up to, but not including, 6.1.178; 6.6.142 up to, but not including, 6.6.145; 6.12.92 up to, but not including, 6.12.96; 6.18.34 up to, but not including, 6.18.39; 7.0.11 up to, but not including, 7.1; 7.1.1 up to, but not including, 7.1.4; and 2 more ranges5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept_dequeue() bt_accept_get() takes a temporary reference before dropping the accept queue lock. bt_accept_dequeue() currently drops that reference before bt_accept_unlink(), leaving only the queue reference. bt_accept_unlink() drops the queue reference. The subsequent sock_hold() therefore accesses freed memory if it was the final reference, as observed by KASAN during listening L2CAP socket cleanup. Retain the temporary queue-walk reference through unlink and hand it to the caller on success. Drop it explicitly on the closed and not-yet-connected paths.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.