CVE-2026-97977Bluetooth: btusb: Fix UAF of btusb_data by rx_work
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix UAF of btusb_data by rx_work btusb_close() and btusb_flush() cancel data->rx_work with the asynchronous cancel_delayed_work(), so if btusb_rx_work() is already running on another CPU it keeps running after the cancel returns. btusb_disconnect() calls hci_unregister_dev(), which invokes btusb_close(), and then frees the btusb_data. A still running btusb_rx_work() then dereferences the freed data: while ((skb = skb_dequeue(&data->acl_q))) data->recv_acl(data->hdev, skb); Use cancel_delayed_work_sync() instead. In btusb_close() the cancel also has to happen after btusb_stop_traffic(), otherwise an URB completion racing with the cancel can requeue the work right after it has been waited for.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 800fe5ec302e1ebbf5e3f891f886deecd49c7132 before fc654a72a8d979db15e2773a481e931abaf5a9e8; from 800fe5ec302e1ebbf5e3f891f886deecd49c7132 before 5242050195a711e9cd6a9935f689ab6656b94a91; 800fe5ec302e1ebbf5e3f891f886deecd49c7132 builds before 472d005622525b7be155cac99dde2252b0163bd1; 800fe5ec302e1ebbf5e3f891f886deecd49c7132 builds before 93b59937bda3fffc6386c79f5544a39bc680c8e8; from 800fe5ec302e1ebbf5e3f891f886deecd49c7132 before fa391adb9c755515a89993634745e9079e5ef37c; 800fe5ec302e1ebbf5e3f891f886deecd49c7132 builds before 1c12c3117639e78940959d956519c758c57d0849 | CNA record |
References
- https://git.kernel.org/stable/c/fc654a72a8d979db15e2773a481e931abaf5a9e8
- https://git.kernel.org/stable/c/5242050195a711e9cd6a9935f689ab6656b94a91
- https://git.kernel.org/stable/c/472d005622525b7be155cac99dde2252b0163bd1
- https://git.kernel.org/stable/c/93b59937bda3fffc6386c79f5544a39bc680c8e8
- https://git.kernel.org/stable/c/fa391adb9c755515a89993634745e9079e5ef37c
- https://git.kernel.org/stable/c/1c12c3117639e78940959d956519c758c57d0849
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.