CVE-2026-97975: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel()
A NULL pointer dereference in klistput() occurs when a child device (such as a BNEP network device in bnepsession) is concurrently being unregistered while hciconndelsysfs() reparents child devices.
This is caused by a race condition between hciconndelsysfs() and concurrent child device unregistration (e.g. bnepsession calling unregisternetdev()). During device unregistration, devicedel() snapshots a non-NULL parent pointer. Concurrently, hciconndelsysfs() finds the child device using devicefindanychild() and calls devicemove() to reparent it to NULL, which removes the node from its parent's klist and clears knodeparent. Subsequently, devicedel() calls klistdel(&dev->p->knodeparent) using the stale parent snapshot, causing klistput() to dereference knodeklist(n)->put on an already removed node, resulting in a NULL pointer dereference.
This race was introduced by commit 27aabf27fd01 ("Bluetooth: fix use-after-free in deviceforeachchild()"), which replaced devicefindchild(..., matchtty) with devicefindanychild() in hciconndelsysfs(). That change was intended to avoid a use-after-free where conn->dev outlived its parent hdev->dev when child devices held references to conn->dev, because conn->dev only held a reference to hdev->dev while registered in sysfs.
Fix the issue properly by taking an explicit reference to the parent device with getdevice(&hdev->dev) in hciconninitsysfs() and dropping it with putdevice(parent) in btlinkrelease() when the conn device is freed. This ensures that hdev->dev remains valid for the entire lifecycle of conn->dev, resolving the underlying use-after-free. With the parent reference held properly, restore the matchtty filter in hciconndelsysfs() so that devicemove() is only invoked on persistent RFCOMM TTY devices as originally intended, eliminating the race condition with unregistering network devices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel Bluetooth sysfs code, take an explicit reference to hdev->dev with get_device() in hci_conn_init_sysfs(), release it with put_device(parent) in bt_link_release(), and restore the __match_tty filter in hci_conn_del_sysfs().
Event History
Frequently Asked Questions
Which systems are exposed to this race?
Linux kernel systems using Bluetooth HCI sysfs where child devices are present can be exposed. The described example is a BNEP network device being unregistered while Bluetooth connection sysfs cleanup reparents child devices.
What must happen for the failure to occur?
Child-device unregistration must run concurrently with hci_conn_del_sysfs() reparenting that child device. The conflicting operations can leave device_del() using a stale parent reference and trigger a NULL pointer dereference in klist_put().