CVE-2026-99008: Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Fix NULL ttydev dereference in rfcommdevshutdown

syzbot hit a NULL pointer dereference in rfcommdevshutdown() when an RFCOMM tty is closed.

rfcommdevadd() puts the new device on rfcommdevlist first and only then registers the tty device and saves it in dev->ttydev. If that registration fails, dev->ttydev is never set at all. The device can be looked up in the meantime, so an open() of /dev/rfcommN gets through rfcommttyinstall() and attaches to it. When that tty is closed again, rfcommdevshutdown() uses dev->ttydev without checking it:

Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] RIP: 0010:rfcommdevshutdown+0x48/0xb0 net/bluetooth/rfcomm/tty.c:131 Call Trace: ttyportshutdown+0x1bf/0x220 drivers/tty/ttyport.c:372 ttyportclose+0x4e/0x150 drivers/tty/ttyport.c:705 ttyrelease+0x359/0x1670 drivers/tty/ttyio.c:1718 fput+0x418/0xa50 fs/filetable.c:512

rfcommdevdestruct() already copes with a NULL dev->ttydev. Add the same check to rfcommdevshutdown(), so the tty device is only moved when it was actually registered.