From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C9EF749365D for ; Fri, 25 Sep 2026 10:31:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790332265; cv=none; b=Cn6ggw9pOUfU0MvK+XV9vC7GFE6OouxPTtSPqoqSOn7xHdwcGldjVivhyovMvxZsLrxLbNpilvChsE+C3FVN5G3ZlHyRjcAxHgSA/EYtoTvbvce3lKJwBBIPBk3SJEO947Az5FmfT6oRFyD1V4RRS2YRo1f8ZbY+IT+nj168xOg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790332265; c=relaxed/simple; bh=dFKnBYPDmK+sYzbXsPkMueGyN1QxVNv+5bjKmjrW364=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=lb1H2gsTwiXVcq/y7wBvAbn70meaL9x1HeFdCAZdab8Uqa80YvYn2CB0RbgbR3HDJtiWnn61g49GGYv0R7hTJpwfYmU91Y+UHkBF7+GLqLyFZZLsoo3wioE4VHRM8dvi+HQgCixv2FKPtYTxeZqzPwZiye7qYrEvHVhVBq2QzsM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=xcLBuYnn; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="xcLBuYnn" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 314961F000FF; Fri, 25 Sep 2026 10:31:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1790332263; bh=Yr6kwoXV6NJ1q9PjNCTTbjrMVpGyF1K74alpEJsPDgU=; h=From:To:Cc:Subject:Date:Reply-To; b=xcLBuYnnQl80m2u5gi9mba7YsUJIq7r6aKTwMRmx2oJLP07VEW9iOBAiWTWo6dmax FnPtyWrTmoztKJx69LTOTo4G2A2Ook1ZImdVCrrjGisjzGNH9GN8fmatUbSLGlCcS8 rIFrUZzcYLNZPAYR1lAOa54Ua8RFAxSrBOlHWJsM= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-97975: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() Date: Fri, 25 Sep 2026 12:24:38 +0200 Message-ID: <2026092518-CVE-2026-97975-e419@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4533; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=YVrgXRSgOQN3Wa4zR9Qzysl6En+xxIMhMilo6rUg4KY=; b=owGbwMvMwCRo6H6F97bub03G02pJDFnbvKNS7YVs5JM3mmcsC93Jn2cidURbbKfNETX77v2zz Ey5HszpiGVhEGRikBVTZPmyjefo/opDil6Gtqdh5rAygQxh4OIUgIlYfWRYcKVkx7f35Wq/XrIk cxV+/Pt+ysvydoYFrY8YpCeuP3M/acODPY53OwsjU5WSAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() A NULL pointer dereference in klist_put() occurs when a child device (such as a BNEP network device in bnep_session) is concurrently being unregistered while hci_conn_del_sysfs() reparents child devices. This is caused by a race condition between hci_conn_del_sysfs() and concurrent child device unregistration (e.g. bnep_session calling unregister_netdev()). During device unregistration, device_del() snapshots a non-NULL parent pointer. Concurrently, hci_conn_del_sysfs() finds the child device using device_find_any_child() and calls device_move() to reparent it to NULL, which removes the node from its parent's klist and clears knode_parent. Subsequently, device_del() calls klist_del(&dev->p->knode_parent) using the stale parent snapshot, causing klist_put() to dereference knode_klist(n)->put on an already removed node, resulting in a NULL pointer dereference. This race was introduced by commit 27aabf27fd01 ("Bluetooth: fix use-after-free in device_for_each_child()"), which replaced device_find_child(..., __match_tty) with device_find_any_child() in hci_conn_del_sysfs(). That change was intended to avoid a use-after-free where conn->dev outlived its parent hdev->dev when child devices held references to conn->dev, because conn->dev only held a reference to hdev->dev while registered in sysfs. Fix the issue properly by taking an explicit reference to the parent device with get_device(&hdev->dev) in hci_conn_init_sysfs() and dropping it with put_device(parent) in bt_link_release() when the conn device is freed. This ensures that hdev->dev remains valid for the entire lifecycle of conn->dev, resolving the underlying use-after-free. With the parent reference held properly, restore the __match_tty filter in hci_conn_del_sysfs() so that device_move() is only invoked on persistent RFCOMM TTY devices as originally intended, eliminating the race condition with unregistering network devices. The Linux kernel CVE team has assigned CVE-2026-97975 to this issue. Affected and fixed versions =========================== Issue introduced in 6.13 with commit 27aabf27fd014ae037cc179c61b0bee7cff55b3d and fixed in 6.18.53 with commit eeabdb25c3209569367e99a85ca9a503b64a646d Issue introduced in 6.13 with commit 27aabf27fd014ae037cc179c61b0bee7cff55b3d and fixed in 7.2.7 with commit 9e9ece97b8e716890793de261574b8efef7d8702 Issue introduced in 6.13 with commit 27aabf27fd014ae037cc179c61b0bee7cff55b3d and fixed in 7.3-rc3 with commit 9b851b09b392da68bd715601f10a5adb2d8d19b8 Issue introduced in 5.4.297 with commit 6894717a1ea363c5a27010ba604f957c309d282d Issue introduced in 5.10.231 with commit fb91ce37dc9a37ea23cf32b6d7b667004e93d4c5 Issue introduced in 5.15.174 with commit a9584c897d1cba6265c78010bbb45ca5722c88bc Issue introduced in 6.1.120 with commit 0f67ca2a80acf8b207240405b7f72d660665d3df Issue introduced in 6.6.64 with commit de5a44f351ca7efd9add9851b218f5353e2224b7 Issue introduced in 6.11.11 with commit 91e2a2e4d1336333804cd31162984f01ad8cc70f Issue introduced in 6.12.2 with commit 7b277bd569bb6a2777f0014f84b4344f444fd49d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-97975 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/bluetooth/hci_sysfs.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/eeabdb25c3209569367e99a85ca9a503b64a646d https://git.kernel.org/stable/c/9e9ece97b8e716890793de261574b8efef7d8702 https://git.kernel.org/stable/c/9b851b09b392da68bd715601f10a5adb2d8d19b8