Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-23146

Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling hci_uart_register_dev(), which calls proto->open() to initialize hu->priv. However, if a TTY write wakeup occurs during this window, hci_uart_tx_wakeup() may schedule write_work before hu->priv is initialized, leading to a NULL pointer dereference in hci_uart_write_work() when proto->dequeue() accesses hu->priv. The race condition is: CPU0 CPU1 ---- ---- hci_uart_set_proto() set_bit(HCI_UART_PROTO_INIT) hci_uart_register_dev() tty write wakeup hci_uart_tty_wakeup() hci_uart_tx_wakeup() schedule_work(&hu->write_work) proto->open(hu) // initializes hu->priv hci_uart_write_work() hci_uart_dequeue() proto->dequeue(hu) // accesses hu->priv (NULL!) Fix this by moving set_bit(HCI_UART_PROTO_INIT) after proto->open() succeeds, ensuring hu->priv is initialized before any work can be scheduled.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • a40f94f7caa8d3421b64f63ac31bc0f24c890f39 to < b0a900939e7e4866d9b90e9112514b72c451e873affected
  • 9e5a0f5777162e503400c70c6ed25fbbe2d38799 to < ccc683f597ceb28deb966427ae948e5ac739a909affected
  • 80f14e9de6a43a0bd8194cad1003a3e6dcbc3984 to < 937a573423ce5a96fdb1fd425dc6b8d8d4ab5779affected
  • 02e1bcdfdf769974e7e9fa285e295cd9852e2a38 to < 186d147cf7689ba1f9b3ddb753ab634a84940cc9affected
  • 281782d2c6730241e300d630bb9f200d831ede71 to < 53e54cb31e667fca05b1808b990eac0807d1dab0affected
  • 5df5dafc171b90d0b8d51547a82657cd5a1986c7 to < 03e8c90c62233382042b7bd0fa8b8900552fdb62affected
  • 5df5dafc171b90d0b8d51547a82657cd5a1986c7 to < 0c3cd7a0b862c37acbee6d9502107146cc944398affected
  • 1dcf08fcff5ca529de6dc0395091f28854f4e54aaffected
  • 8e5aff600539e5faea294d9612cca50220e602b8affected
  • db7509fa110dd9b11134b75894677f30353b2c51affected
  • 5.10.237 to < 5.10.249affected
  • 5.15.181 to < 5.15.199affected
  • 6.1.135 to < 6.1.162affected
  • 6.6.88 to < 6.6.123affected
  • 6.12.24 to < 6.12.69affected
  • 5.4.293 to < 5.5affected
  • 6.13.12 to < 6.14affected
  • 6.14.3 to < 6.15affected

Linux Linux

Default version status: affected

  • 6.15affected
  • 0 to < 6.15unaffected
  • 5.10.249 to ≤ 5.10.*unaffected
  • 5.15.199 to ≤ 5.15.*unaffected
  • 6.1.162 to ≤ 6.1.*unaffected
  • 6.6.123 to ≤ 6.6.*unaffected
  • 6.12.69 to ≤ 6.12.*unaffected
  • 6.18.9 to ≤ 6.18.*unaffected
  • 6.19 to ≤ *unaffected

References