CVE-2026-97975: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()

A NULL pointer dereference in klist_put() occurs when a child device (such
as a BNEP network device in bnep_session) is concurrently being
unregistered while hci_conn_del_sysfs() reparents child devices.

This is caused by a race condition between hci_conn_del_sysfs() and
concurrent child device unregistration (e.g. bnep_session calling
unregister_netdev()). During device unregistration, device_del() snapshots
a non-NULL parent pointer. Concurrently, hci_conn_del_sysfs() finds the
child device using device_find_any_child() and calls device_move() to
reparent it to NULL, which removes the node from its parent's klist and
clears knode_parent. Subsequently, device_del() calls
klist_del(&dev->p->knode_parent) using the stale parent snapshot, causing
klist_put() to dereference knode_klist(n)->put on an already removed node,
resulting in a NULL pointer dereference.

This race was introduced by commit 27aabf27fd01 ("Bluetooth: fix
use-after-free in device_for_each_child()"), which replaced
device_find_child(..., __match_tty) with device_find_any_child() in
hci_conn_del_sysfs(). That change was intended to avoid a use-after-free
where conn->dev outlived its parent hdev->dev when child devices held
references to conn->dev, because conn->dev only held a reference to
hdev->dev while registered in sysfs.

Fix the issue properly by taking an explicit reference to the parent device
with get_device(&hdev->dev) in hci_conn_init_sysfs() and dropping it with
put_device(parent) in bt_link_release() when the conn device is freed. This
ensures that hdev->dev remains valid for the entire lifecycle of conn->dev,
resolving the underlying use-after-free. With the parent reference held
properly, restore the __match_tty filter in hci_conn_del_sysfs() so that
device_move() is only invoked on persistent RFCOMM TTY devices as
originally intended, eliminating the race condition with unregistering
network devices.

The Linux kernel CVE team has assigned CVE-2026-97975 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.13 with commit 27aabf27fd014ae037cc179c61b0bee7cff55b3d and fixed in 6.18.53 with commit eeabdb25c3209569367e99a85ca9a503b64a646d
	Issue introduced in 6.13 with commit 27aabf27fd014ae037cc179c61b0bee7cff55b3d and fixed in 7.2.7 with commit 9e9ece97b8e716890793de261574b8efef7d8702
	Issue introduced in 6.13 with commit 27aabf27fd014ae037cc179c61b0bee7cff55b3d and fixed in 7.3-rc3 with commit 9b851b09b392da68bd715601f10a5adb2d8d19b8
	Issue introduced in 5.4.297 with commit 6894717a1ea363c5a27010ba604f957c309d282d
	Issue introduced in 5.10.231 with commit fb91ce37dc9a37ea23cf32b6d7b667004e93d4c5
	Issue introduced in 5.15.174 with commit a9584c897d1cba6265c78010bbb45ca5722c88bc
	Issue introduced in 6.1.120 with commit 0f67ca2a80acf8b207240405b7f72d660665d3df
	Issue introduced in 6.6.64 with commit de5a44f351ca7efd9add9851b218f5353e2224b7
	Issue introduced in 6.11.11 with commit 91e2a2e4d1336333804cd31162984f01ad8cc70f
	Issue introduced in 6.12.2 with commit 7b277bd569bb6a2777f0014f84b4344f444fd49d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-97975
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bluetooth/hci_sysfs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/eeabdb25c3209569367e99a85ca9a503b64a646d
	https://git.kernel.org/stable/c/9e9ece97b8e716890793de261574b8efef7d8702
	https://git.kernel.org/stable/c/9b851b09b392da68bd715601f10a5adb2d8d19b8