CVE-2026-64433

A flaw was found in the Linux kernel's Bluetooth Management (MGMT) subsystem. A use-after-free (UAF) vulnerability exists in the add_device_complete() function. This occurs because the function does not properly acquire a lock before accessing connection parameters, allowing a concurrent device removal operation to free memory that is still in use. An attacker could potentially exploit this to cause a denial of service or achieve arbitrary code execution.

This vulnerability is rated as Moderate severity because exploitation requires local access with privileges to communicate with the Bluetooth management interface, and the primary impact is a system crash causing a denial of service. Successfully triggering the condition depends on winning a race condition between concurrent device management requests while Bluetooth operations are active. Enterprise server environments lacking Bluetooth hardware or services are not exposed in default configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.