CVE-2026-97908: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.7-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.111 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.53 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In btqcomsmd teardown, destroy the command and ACL RPMsg endpoints before calling hci_free_dev(); during driver removal, call hci_unregister_dev() first, then shut down the transport endpoints. In the hci_register_dev() registration-error cleanup path, return directly after freeing hci_dev to avoid falling through to partial-construction labels and destroying the endpoints twice.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel btqcomsmd Bluetooth transport with Qualcomm WCNSS and its command or ACL RPMsg endpoints are exposed. The issue is in teardown and error-cleanup paths rather than normal Bluetooth data processing.
What condition is required to trigger the use-after-free?
WCNSS must deliver data after the HCI device has been freed but before the RPMsg endpoints are destroyed. In that window, an endpoint receive callback can dereference and pass the freed HCI device to the Bluetooth core.
Is the issue limited to driver removal?
No. The unsafe teardown order exists both when the driver is removed and when HCI device registration fails and cleanup runs.
What does the fix change?
The fix destroys the command and ACL RPMsg endpoints before freeing the HCI device, preventing new callbacks and synchronizing with callbacks already in progress. During removal, it retains HCI unregistration before transport shutdown so the HCI core stops issuing operations first.