Riskcovery

CVE-2026-97977

Bluetooth: btusb: Fix UAF of btusb_data by rx_work

State
Published
Severity
Not scored
Published
Sep 25, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: Fix UAF of btusb_data by rx_work

btusb_close() and btusb_flush() cancel data->rx_work with the asynchronous cancel_delayed_work(), so if btusb_rx_work() is already running on another CPU it keeps running after the cancel returns.

btusb_disconnect() calls hci_unregister_dev(), which invokes btusb_close(), and then frees the btusb_data. A still running btusb_rx_work() then dereferences the freed data:

while ((skb = skb_dequeue(&data->acl_q))) data->recv_acl(data->hdev, skb);

Use cancel_delayed_work_sync() instead. In btusb_close() the cancel also has to happen after btusb_stop_traffic(), otherwise an URB completion racing with the cancel can requeue the work right after it has been waited for.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 800fe5ec302e1ebbf5e3f891f886deecd49c7132 to before fc654a72a8d979db15e2773a481e931abaf5a9e8Affected
  • 800fe5ec302e1ebbf5e3f891f886deecd49c7132 to before 5242050195a711e9cd6a9935f689ab6656b94a91Affected
  • 800fe5ec302e1ebbf5e3f891f886deecd49c7132 to before 472d005622525b7be155cac99dde2252b0163bd1Affected
  • 800fe5ec302e1ebbf5e3f891f886deecd49c7132 to before 93b59937bda3fffc6386c79f5544a39bc680c8e8Affected
  • 800fe5ec302e1ebbf5e3f891f886deecd49c7132 to before fa391adb9c755515a89993634745e9079e5ef37cAffected
  • 800fe5ec302e1ebbf5e3f891f886deecd49c7132 to before 1c12c3117639e78940959d956519c758c57d0849Affected
LinuxLinux
  • 5.17Affected
  • before 5.17Not affected
  • 6.1.189 through 6.1.*Not affected
  • 6.6.158 through 6.6.*Not affected
  • 6.12.111 through 6.12.*Not affected
  • 6.18.53 through 6.18.*Not affected
  • 7.2.7 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.