Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-99008
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-23 13:17:23 UTC
Updated2026-10-23 13:17:23 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown syzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an RFCOMM tty is closed. rfcomm_dev_add() puts the new device on rfcomm_dev_list first and only then registers the tty device and saves it in dev->tty_dev. If that registration fails, dev->tty_dev is never set at all. The device can be looked up in the meantime, so an open() of /dev/rfcommN gets through rfcomm_tty_install() and attaches to it. When that tty is closed again, rfcomm_dev_shutdown() uses dev->tty_dev without checking it: Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] RIP: 0010:rfcomm_dev_shutdown+0x48/0xb0 net/bluetooth/rfcomm/tty.c:131 Call Trace: tty_port_shutdown+0x1bf/0x220 drivers/tty/tty_port.c:372 tty_port_close+0x4e/0x150 drivers/tty/tty_port.c:705 tty_release+0x359/0x1670 drivers/tty/tty_io.c:1718 __fput+0x418/0xa50 fs/file_table.c:512 rfcomm_dev_destruct() already copes with a NULL dev->tty_dev. Add the same check to rfcomm_dev_shutdown(), so the tty device is only moved when it was actually registered.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected cad348a17e170451ea8688b532a6ca3e98c63b60 d5c372ad03330f02962d4860df4d355ab25487df git Not specified
CNA Linux Linux affected cad348a17e170451ea8688b532a6ca3e98c63b60 3fd5164bdb04635caa7942ddb554b0ec699a9433 git Not specified
CNA Linux Linux affected cad348a17e170451ea8688b532a6ca3e98c63b60 a661f401f83b8462f2d424e0a1a72b7681e92ea2 git Not specified
CNA Linux Linux affected cad348a17e170451ea8688b532a6ca3e98c63b60 d0aef0b0374678153244f162df507106d728af39 git Not specified
CNA Linux Linux affected cad348a17e170451ea8688b532a6ca3e98c63b60 08e90633377f1b2567ab5ad6810b74c552246a07 git Not specified
CNA Linux Linux affected 3.12 Not specified
CNA Linux Linux unaffected 3.12 semver Not specified
CNA Linux Linux unaffected 6.6.160 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.113 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.57 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.11 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/d0aef0b0374678153244f162df507106d728af39 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d5c372ad03330f02962d4860df4d355ab25487df 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a661f401f83b8462f2d424e0a1a72b7681e92ea2 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/08e90633377f1b2567ab5ad6810b74c552246a07 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3fd5164bdb04635caa7942ddb554b0ec699a9433 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report