Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-93247
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-24 16:17:20 UTC
Updated2026-09-24 16:17:20 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference 'uuid_count' member of struct 'discovery_state' is assigned and read without any locks, so there is a chance of situation when uuid_count != 0, but uuids is NULL and there will be NULL pointer dereference. Possible race: 'hci_update_passive_scan_sync' 'hci_discovery_filter_clear' hdev->discovery.uuid_count = 0; <----------------------preempted-----------------------------> 'start_service_discovery' // Set uuid_count to value != 0 hdev->discovery.uuid_count = uuid_count; hdev->discovery.uuids = kmemdup(...); <----------------------preempted-----------------------------> spin_lock(&hdev->discovery.lock); kfree(hdev->discovery.uuids); hdev->discovery.uuids = NULL; spin_unlock(&hdev->discovery.lock); Now uuids == NULL and uuid_count != 0. So 'mgmt_device_found' -> 'is_filter_match' -> 'eir_has_uuids' receives non consistent discovery state, where NULL dereference of uuids happens. To fix it let's add discovery.lock around every read/write of uuid_count, uuids pair of struct members. It is also important to assign uuid_count value only after success kmemdup() allocation in start_service_discovery(), otherwise uuids is NULL, because kmemdup failed, but uuid_count is already assigned to non zero value. The following panic happens: [ ] ------------[ cut here ]------------ [ ] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ ] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP [ ] CPU: 0 PID: 15056 Comm: kworker/u9:2 [ ] Workqueue: hci0 hci_rx_work [ ] pstate: 10400009 (nzcV daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ ] pc : eir_has_uuids+0x2d8/0x590 [ ] lr : is_filter_match+0x258/0x320 ... [ ] Call trace: [ ] eir_has_uuids+0x2d8/0x590 [ ] is_filter_match+0x258/0x320 [ ] mgmt_device_found+0x5b0/0xafc [ ] process_adv_report.part.0+0x8c8/0xf14 [ ] hci_le_adv_report_evt+0x338/0x3f0 [ ] hci_le_meta_evt+0x1f0/0x4c8 [ ] hci_event_packet+0x440/0xc9c [ ] hci_rx_work+0x44c/0xaf8 [ ] process_one_work+0x54c/0x103c [ ] worker_thread+0x6c4/0x10c4 [ ] kthread+0x274/0x2ec [ ] ret_from_fork+0x10/0x20 [ ] Code: 14000004 91004021 eb14003f 54000180 (f9400024) [ ] ---[ end trace 0000000000000000 ]---

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 86f3dcd1f331cfd4fd7ec88906955134ec51afbe f02c01ccd12cb2b8a290077d4c90f29a6e109b16 git Not specified
CNA Linux Linux affected 7ce9bb0b95fc280e9212b8922590c492ca1d9c39 bbd262d2d750b67b15a5e1008d3848309c87e7a7 git Not specified
CNA Linux Linux affected 16852eccbdfaf41a666705e3f8be55cf2864c5ca 18fda026a13c5abd6c1e0dfd3549f490b73378fb git Not specified
CNA Linux Linux affected 2935e556850e9c94d7a00adf14d3cd7fe406ac03 c3f63610bceaa182e4683b23cc47baf36b5f1496 git Not specified
CNA Linux Linux affected 2935e556850e9c94d7a00adf14d3cd7fe406ac03 ee2135a14fb2a3e176149122764d293f0796b1eb git Not specified
CNA Linux Linux affected 2935e556850e9c94d7a00adf14d3cd7fe406ac03 59eecbe2f2f38d8f3e1104bd11da97f9a2c58998 git Not specified
CNA Linux Linux affected a351ff6b8ecca4229afaa0d98042bead8de64799 git Not specified
CNA Linux Linux affected f8069f34c4c976786ded97498012225af87435d7 git Not specified
CNA Linux Linux affected 6.1.159 6.1.188 semver Not specified
CNA Linux Linux affected 6.6.117 6.6.157 semver Not specified
CNA Linux Linux affected 6.12.42 6.12.110 semver Not specified
CNA Linux Linux affected 6.15.10 6.16 semver Not specified
CNA Linux Linux affected 6.16.1 6.17 semver Not specified
CNA Linux Linux affected 6.17 Not specified
CNA Linux Linux unaffected 6.17 semver Not specified
CNA Linux Linux unaffected 6.1.188 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.157 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.110 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.52 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.6 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/bbd262d2d750b67b15a5e1008d3848309c87e7a7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c3f63610bceaa182e4683b23cc47baf36b5f1496 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/59eecbe2f2f38d8f3e1104bd11da97f9a2c58998 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/18fda026a13c5abd6c1e0dfd3549f490b73378fb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f02c01ccd12cb2b8a290077d4c90f29a6e109b16 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ee2135a14fb2a3e176149122764d293f0796b1eb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report