UBUNTU-CVE-2026-97908: Low severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq->hdev without taking an hcidev reference. The current teardown order frees the hcidev before destroying the RPMsg endpoints in both the hciregisterdev() error path and the driver remove path. If WCNSS delivers data in that window, the endpoint callback can run with an already freed hcidev and pass it to the Bluetooth core. For qcomsmd endpoints, rpmsgdestroyept() closes the channel and clears the callback under the channel recvlock. The receive path holds the same lock while invoking the callback, so destroying the endpoints first both prevents new callbacks and serializes with any callback already running. Destroy the command and ACL endpoints before hcifreedev(). Keep hciunregisterdev() first during remove so the HCI core stops issuing operations before the transport endpoints are shut down. In the full registration-error cleanup path, return directly after freeing the hcidev to avoid falling through to the partial-construction labels and destroying the endpoints twice.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In btqcomsmd teardown, call rpmsg_destroy_ept() for the command and ACL RPMsg endpoints before hci_free_dev(); during driver removal, keep hci_unregister_dev() first so the HCI core stops issuing operations before the endpoints are shut down.
- Compensating control
In the full registration-error cleanup path, return directly after freeing hci_dev instead of falling through to partial-construction cleanup labels that would destroy the RPMsg endpoints twice.