UBUNTU-CVE-2026-97975: Use After Free

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel() A NULL pointer dereference in klistput() occurs when a child device (such as a BNEP network device in bnepsession) is concurrently being unregistered while hciconndelsysfs() reparents child devices. This is caused by a race condition between hciconndelsysfs() and concurrent child device unregistration (e.g. bnepsession calling unregisternetdev()). During device unregistration, devicedel() snapshots a non-NULL parent pointer. Concurrently, hciconndelsysfs() finds the child device using devicefindanychild() and calls devicemove() to reparent it to NULL, which removes the node from its parent's klist and clears knodeparent. Subsequently, devicedel() calls klistdel(&dev->p->knodeparent) using the stale parent snapshot, causing klistput() to dereference knodeklist(n)->put on an already removed node, resulting in a NULL pointer dereference. This race was introduced by commit 27aabf27fd01 ("Bluetooth: fix use-after-free in deviceforeachchild()"), which replaced devicefindchild(..., matchtty) with devicefindanychild() in hciconndelsysfs(). That change was intended to avoid a use-after-free where conn->dev outlived its parent hdev->dev when child devices held references to conn->dev, because conn->dev only held a reference to hdev->dev while registered in sysfs. Fix the issue properly by taking an explicit reference to the parent device with getdevice(&hdev->dev) in hciconninitsysfs() and dropping it with putdevice(parent) in btlinkrelease() when the conn device is freed. This ensures that hdev->dev remains valid for the entire lifecycle of conn->dev, resolving the underlying use-after-free. With the parent reference held properly, restore the matchtty filter in hciconndelsysfs() so that devicemove() is only invoked on persistent RFCOMM TTY devices as originally intended, eliminating the race condition with unregistering network devices.