CVE-2026-64178

A flaw was found in the Linux kernel's Bluetooth Network Encapsulation Protocol (BNEP) module. A local attacker with administrative network capabilities (CAP_NET_ADMIN) could exploit a use-after-free vulnerability in the bnep_add_connection() function. This occurs because the function fails to properly manage a semaphore while reading device names, allowing a concurrent operation to free the network device. While difficult to exploit due to timing requirements and privilege prerequisites, this flaw could potentially lead to system instability or information disclosure.

This vulnerability is rated as Moderate severity because exploitation requires local access with elevated privileges (specifically CAP_NET_ADMIN) and depends on winning a narrow race condition during network interface teardown. In typical enterprise and server environments, Bluetooth services and hardware are seldom active, substantially restricting the attack surface. An attacker with the necessary network administration privileges could potentially cause a denial of service via a kernel crash, but the flaw cannot be triggered remotely or by unprivileged users.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.