CVE-2026-64144

Bluetooth: btmtk: fix urb->setup_packet leak in error paths

MEDIUM

5.5

CVSS Score

Published: July 19, 2026 at 03:40 PM UTC

Updated: August 17, 2026 at 07:55 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix urb->setup_packet leak in error paths The setup_packet of control urb is not freed if usb_submit_urb fails or the submitted urb is killed. Add free in these two paths.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.3 ≤ v < 6.12.925.3 ≤ v < 6.18.345.3 ≤ v < 6.6.1425.3 ≤ v < 7.0.115.3 ≤ v < 7.16.13 ≤ v < 6.18.346.19 ≤ v < 7.0.116.7 ≤ v < 6.12.927.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4a1c49c434e15050b5dafe3b6f5cc732d4f02d657

Vendor states this is fixed in 0d2572bafea33c7cd1d77c6a25f25ff31a432482 (fixed)

Vendor states this is fixed in 2a1905730e0c771b999906a7b509722f795563c6 (fixed)

Vendor states this is fixed in 68c027c2003b0a8a1439d0301c59c6fd1eb3b844 (fixed)

Vendor states this is fixed in a0f5268c77eb73f84ba7c210ddfc54b1c73ff80c (fixed)

Vendor states this is fixed in dd1dda6b8d6e1f4376a5b3055a04f0ecbdb4d6bd (fixed)

Vendor states this is fixed in 5.3 (unaffected)

Vendor states this is fixed in 6.12.92 (unaffected)

Vendor states this is fixed in 6.18.34 (unaffected)

Vendor states this is fixed in 6.6.142 (unaffected)

Vendor states this is fixed in 7.0.11 (unaffected)

Vendor states this is fixed in 7.1 (unaffected)