CVE-2026-97908: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev
The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq->hdev without taking an hcidev reference.
The current teardown order frees the hcidev before destroying the RPMsg endpoints in both the hciregisterdev() error path and the driver remove path. If WCNSS delivers data in that window, the endpoint callback can run with an already freed hcidev and pass it to the Bluetooth core.
For qcomsmd endpoints, rpmsgdestroyept() closes the channel and clears the callback under the channel recvlock. The receive path holds the same lock while invoking the callback, so destroying the endpoints first both prevents new callbacks and serializes with any callback already running.
Destroy the command and ACL endpoints before hcifreedev(). Keep hciunregisterdev() first during remove so the HCI core stops issuing operations before the transport endpoints are shut down. In the full registration-error cleanup path, return directly after freeing the hcidev to avoid falling through to the partial-construction labels and destroying the endpoints twice.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In btqcomsmd teardown, destroy the command and ACL RPMsg endpoints with rpmsg_destroy_ept() before calling hci_free_dev(); during driver removal, call hci_unregister_dev() first so the HCI core stops issuing operations, and apply the same endpoint-destruction order in the hci_register_dev() error path.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel btqcomsmd Bluetooth transport with Qualcomm WCNSS and its command or ACL RPMsg endpoints are exposed. The issue is in teardown and error-cleanup paths rather than normal Bluetooth data processing.
What condition is required to trigger the use-after-free?
WCNSS must deliver data after the HCI device has been freed but before the RPMsg endpoints are destroyed. In that window, an endpoint receive callback can dereference and pass the freed HCI device to the Bluetooth core.
Is the issue limited to driver removal?
No. The unsafe teardown order exists both when the driver is removed and when HCI device registration fails and cleanup runs.
What does the fix change?
The fix destroys the command and ACL RPMsg endpoints before freeing the HCI device, preventing new callbacks and synchronizing with callbacks already in progress. During removal, it retains HCI unregistration before transport shutdown so the HCI core stops issuing operations first.