Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-97975
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-25 11:17:25 UTC
Updated2026-09-25 11:17:25 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() A NULL pointer dereference in klist_put() occurs when a child device (such as a BNEP network device in bnep_session) is concurrently being unregistered while hci_conn_del_sysfs() reparents child devices. This is caused by a race condition between hci_conn_del_sysfs() and concurrent child device unregistration (e.g. bnep_session calling unregister_netdev()). During device unregistration, device_del() snapshots a non-NULL parent pointer. Concurrently, hci_conn_del_sysfs() finds the child device using device_find_any_child() and calls device_move() to reparent it to NULL, which removes the node from its parent's klist and clears knode_parent. Subsequently, device_del() calls klist_del(&dev->p->knode_parent) using the stale parent snapshot, causing klist_put() to dereference knode_klist(n)->put on an already removed node, resulting in a NULL pointer dereference. This race was introduced by commit 27aabf27fd01 ("Bluetooth: fix use-after-free in device_for_each_child()"), which replaced device_find_child(..., __match_tty) with device_find_any_child() in hci_conn_del_sysfs(). That change was intended to avoid a use-after-free where conn->dev outlived its parent hdev->dev when child devices held references to conn->dev, because conn->dev only held a reference to hdev->dev while registered in sysfs. Fix the issue properly by taking an explicit reference to the parent device with get_device(&hdev->dev) in hci_conn_init_sysfs() and dropping it with put_device(parent) in bt_link_release() when the conn device is freed. This ensures that hdev->dev remains valid for the entire lifecycle of conn->dev, resolving the underlying use-after-free. With the parent reference held properly, restore the __match_tty filter in hci_conn_del_sysfs() so that device_move() is only invoked on persistent RFCOMM TTY devices as originally intended, eliminating the race condition with unregistering network devices.

Risk And Classification

EPSS: 0.001660000 probability, percentile 0.051930000 (date 2026-09-27)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 27aabf27fd014ae037cc179c61b0bee7cff55b3d eeabdb25c3209569367e99a85ca9a503b64a646d git Not specified
CNA Linux Linux affected 27aabf27fd014ae037cc179c61b0bee7cff55b3d 9e9ece97b8e716890793de261574b8efef7d8702 git Not specified
CNA Linux Linux affected 27aabf27fd014ae037cc179c61b0bee7cff55b3d 9b851b09b392da68bd715601f10a5adb2d8d19b8 git Not specified
CNA Linux Linux affected 6894717a1ea363c5a27010ba604f957c309d282d git Not specified
CNA Linux Linux affected fb91ce37dc9a37ea23cf32b6d7b667004e93d4c5 git Not specified
CNA Linux Linux affected a9584c897d1cba6265c78010bbb45ca5722c88bc git Not specified
CNA Linux Linux affected 0f67ca2a80acf8b207240405b7f72d660665d3df git Not specified
CNA Linux Linux affected de5a44f351ca7efd9add9851b218f5353e2224b7 git Not specified
CNA Linux Linux affected 91e2a2e4d1336333804cd31162984f01ad8cc70f git Not specified
CNA Linux Linux affected 7b277bd569bb6a2777f0014f84b4344f444fd49d git Not specified
CNA Linux Linux affected 5.4.297 5.5 semver Not specified
CNA Linux Linux affected 5.10.231 5.11 semver Not specified
CNA Linux Linux affected 5.15.174 5.16 semver Not specified
CNA Linux Linux affected 6.1.120 6.2 semver Not specified
CNA Linux Linux affected 6.6.64 6.7 semver Not specified
CNA Linux Linux affected 6.11.11 6.12 semver Not specified
CNA Linux Linux affected 6.12.2 6.13 semver Not specified
CNA Linux Linux affected 6.13 Not specified
CNA Linux Linux unaffected 6.13 semver Not specified
CNA Linux Linux unaffected 6.18.53 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.7 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/9e9ece97b8e716890793de261574b8efef7d8702 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9b851b09b392da68bd715601f10a5adb2d8d19b8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/eeabdb25c3209569367e99a85ca9a503b64a646d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report