{"id":"CVE-2026-64144","state":"PUBLISHED","title":"Bluetooth: btmtk: fix urb->setup_packet leak in error paths","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btmtk: fix urb->setup_packet leak in error paths\n\nThe setup_packet of control urb is not freed if usb_submit_urb fails or\nthe submitted urb is killed. Add free in these two paths.","publishedAt":"2026-07-19T15:40:36.041Z","updatedAt":"2026-10-30T12:27:37.325Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a1c49c434e15050b5dafe3b6f5cc732d4f02d657","status":"affected","lessThan":"ecd8d2531766641958a667829907204066cfb51a","versionType":"git"},{"version":"a1c49c434e15050b5dafe3b6f5cc732d4f02d657","status":"affected","lessThan":"2a1905730e0c771b999906a7b509722f795563c6","versionType":"git"},{"version":"a1c49c434e15050b5dafe3b6f5cc732d4f02d657","status":"affected","lessThan":"68c027c2003b0a8a1439d0301c59c6fd1eb3b844","versionType":"git"},{"version":"a1c49c434e15050b5dafe3b6f5cc732d4f02d657","status":"affected","lessThan":"a0f5268c77eb73f84ba7c210ddfc54b1c73ff80c","versionType":"git"},{"version":"a1c49c434e15050b5dafe3b6f5cc732d4f02d657","status":"affected","lessThan":"0d2572bafea33c7cd1d77c6a25f25ff31a432482","versionType":"git"},{"version":"a1c49c434e15050b5dafe3b6f5cc732d4f02d657","status":"affected","lessThan":"dd1dda6b8d6e1f4376a5b3055a04f0ecbdb4d6bd","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bluetooth/btmtk.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.3","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.142","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.92","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.34","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.11","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bluetooth/btmtk.c"]}],"references":["https://git.kernel.org/stable/c/ecd8d2531766641958a667829907204066cfb51a","https://git.kernel.org/stable/c/2a1905730e0c771b999906a7b509722f795563c6","https://git.kernel.org/stable/c/68c027c2003b0a8a1439d0301c59c6fd1eb3b844","https://git.kernel.org/stable/c/a0f5268c77eb73f84ba7c210ddfc54b1c73ff80c","https://git.kernel.org/stable/c/0d2572bafea33c7cd1d77c6a25f25ff31a432482","https://git.kernel.org/stable/c/dd1dda6b8d6e1f4376a5b3055a04f0ecbdb4d6bd"],"weaknesses":[],"ingestedAt":"2026-10-30T12:46:06.359Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64144.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64144","state":"PUBLISHED","datePublished":"2026-07-19T15:40:36.041Z","dateUpdated":"2026-10-30T12:27:37.325Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T07:54:57.037Z"},"containers":{"cna":{"title":"Bluetooth: btmtk: fix urb->setup_packet leak in error paths","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btmtk: fix urb->setup_packet leak in error paths\n\nThe setup_packet of control urb is not freed if usb_submit_urb fails or\nthe submitted urb is killed. Add free in these two paths."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a1c49c434e15050b5dafe3b6f5cc732d4f02d657","status":"affected","lessThan":"ecd8d2531766641958a667829907204066cfb51a","versionType":"git"},{"version":"a1c49c434e15050b5dafe3b6f5cc732d4f02d657","status":"affected","lessThan":"2a1905730e0c771b999906a7b509722f795563c6","versionType":"git"},{"version":"a1c49c434e15050b5dafe3b6f5cc732d4f02d657","status":"affected","lessThan":"68c027c2003b0a8a1439d0301c59c6fd1eb3b844","versionType":"git"},{"version":"a1c49c434e15050b5dafe3b6f5cc732d4f02d657","status":"affected","lessThan":"a0f5268c77eb73f84ba7c210ddfc54b1c73ff80c","versionType":"git"},{"version":"a1c49c434e15050b5dafe3b6f5cc732d4f02d657","status":"affected","lessThan":"0d2572bafea33c7cd1d77c6a25f25ff31a432482","versionType":"git"},{"version":"a1c49c434e15050b5dafe3b6f5cc732d4f02d657","status":"affected","lessThan":"dd1dda6b8d6e1f4376a5b3055a04f0ecbdb4d6bd","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bluetooth/btmtk.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.3","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.142","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.92","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.34","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.11","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bluetooth/btmtk.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ecd8d2531766641958a667829907204066cfb51a"},{"url":"https://git.kernel.org/stable/c/2a1905730e0c771b999906a7b509722f795563c6"},{"url":"https://git.kernel.org/stable/c/68c027c2003b0a8a1439d0301c59c6fd1eb3b844"},{"url":"https://git.kernel.org/stable/c/a0f5268c77eb73f84ba7c210ddfc54b1c73ff80c"},{"url":"https://git.kernel.org/stable/c/0d2572bafea33c7cd1d77c6a25f25ff31a432482"},{"url":"https://git.kernel.org/stable/c/dd1dda6b8d6e1f4376a5b3055a04f0ecbdb4d6bd"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:27:37.325Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.6.142"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.12.92"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.18.34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"7.0.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}