CVE-2026-93247 - Vulnerability Details

- Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference

'uuid_count' member of struct 'discovery_state' is assigned and read
without any locks, so there is a chance of situation when
uuid_count != 0, but uuids is NULL and there will be NULL pointer
dereference.

Possible race:
'hci_update_passive_scan_sync'
'hci_discovery_filter_clear'
hdev->discovery.uuid_count = 0;
<----------------------preempted----------------------------->
'start_service_discovery'
// Set uuid_count to value != 0
hdev->discovery.uuid_count = uuid_count;
hdev->discovery.uuids = kmemdup(...);
<----------------------preempted----------------------------->
spin_lock(&hdev->discovery.lock);
kfree(hdev->discovery.uuids);
hdev->discovery.uuids = NULL;
spin_unlock(&hdev->discovery.lock);

Now uuids == NULL and uuid_count != 0.
So 'mgmt_device_found' -> 'is_filter_match' -> 'eir_has_uuids' receives
non consistent discovery state, where NULL dereference of uuids happens.

To fix it let's add discovery.lock around every read/write of uuid_count,
uuids pair of struct members. It is also important to assign uuid_count
value only after success kmemdup() allocation in
start_service_discovery(), otherwise uuids is NULL, because kmemdup failed,
but uuid_count is already assigned to non zero value.

The following panic happens:

[ ] ------------[ cut here ]------------
[ ] Unable to handle kernel NULL pointer dereference at virtual
address 0000000000000000
[ ] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
[ ] CPU: 0 PID: 15056 Comm: kworker/u9:2
[ ] Workqueue: hci0 hci_rx_work
[ ] pstate: 10400009 (nzcV daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ ] pc : eir_has_uuids+0x2d8/0x590
[ ] lr : is_filter_match+0x258/0x320
...
[ ] Call trace:
[ ] eir_has_uuids+0x2d8/0x590
[ ] is_filter_match+0x258/0x320
[ ] mgmt_device_found+0x5b0/0xafc
[ ] process_adv_report.part.0+0x8c8/0xf14
[ ] hci_le_adv_report_evt+0x338/0x3f0
[ ] hci_le_meta_evt+0x1f0/0x4c8
[ ] hci_event_packet+0x440/0xc9c
[ ] hci_rx_work+0x44c/0xaf8
[ ] process_one_work+0x54c/0x103c
[ ] worker_thread+0x6c4/0x10c4
[ ] kthread+0x274/0x2ec
[ ] ret_from_fork+0x10/0x20
[ ] Code: 14000004 91004021 eb14003f 54000180 (f9400024)
[ ] ---[ end trace 0000000000000000 ]---

Published: 2026-09-24

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition in the Linux kernel Bluetooth management code allows the discovery UUID list pointer to become NULL while the count remains non‑zero, leading to a NULL pointer dereference in the function that processes advertising events. This causes a kernel panic, resulting in a denial of service for the affected system. The weakness is a classic NULL pointer dereference (CWE‑476) compounded by a data‑race (CWE‑1139).

Affected Systems

All Linux kernel builds that include the Bluetooth firmware driver and use the mgmt interface are vulnerable. No specific kernel release is listed, so any kernel that contains the unpatched code path is at risk. Systems running a generic Linux kernel with Bluetooth enabled are therefore impacted.

Risk and Exploitability

The CVSS score is not provided and the EPSS score is unavailable, so the precise likelihood of exploitation is unknown. The kernel crash is deterministic once the race condition occurs, and the attack can be triggered by manipulating Bluetooth advertising packets or active scan synchronization, which can be performed remotely over a Bluetooth radio. The vulnerability is not listed in the CISA KEV catalog at this time. The lack of an around‑the‑corner lock around uuid_count and uuids makes the flaw easy to reproduce in a high‑traffic discovery environment, increasing the risk of accidental crashes even without malicious intent.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`86f3dcd1f331cfd4fd7ec88906955134ec51afbe`	affected	< f02c01ccd12cb2b8a290077d4c90f29a6e109b16
`7ce9bb0b95fc280e9212b8922590c492ca1d9c39`	affected	< bbd262d2d750b67b15a5e1008d3848309c87e7a7
`16852eccbdfaf41a666705e3f8be55cf2864c5ca`	affected	< 18fda026a13c5abd6c1e0dfd3549f490b73378fb
`2935e556850e9c94d7a00adf14d3cd7fe406ac03`	affected	< c3f63610bceaa182e4683b23cc47baf36b5f1496
`2935e556850e9c94d7a00adf14d3cd7fe406ac03`	affected	< ee2135a14fb2a3e176149122764d293f0796b1eb
`2935e556850e9c94d7a00adf14d3cd7fe406ac03`	affected	< 59eecbe2f2f38d8f3e1104bd11da97f9a2c58998
`a351ff6b8ecca4229afaa0d98042bead8de64799`	affected	—
`f8069f34c4c976786ded97498012225af87435d7`	affected	—
`6.1.159`	affected	< 6.1.188
`6.6.117`	affected	< 6.6.157
`6.12.42`	affected	< 6.12.110
`6.15.10`	affected	< 6.16
`6.16.1`	affected	< 6.17

Linux

affected

Version	Status	Constraints
`6.17`	affected	—
`0`	unaffected	< 6.17
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[86f3dcd1f331cfd4fd7ec88906955134ec51afbe,f02c01ccd12cb2b8a290077d4c90f29a6e109b16)`	affected	code_commit	—
`[7ce9bb0b95fc280e9212b8922590c492ca1d9c39,bbd262d2d750b67b15a5e1008d3848309c87e7a7)`	affected	code_commit	—
`[16852eccbdfaf41a666705e3f8be55cf2864c5ca,18fda026a13c5abd6c1e0dfd3549f490b73378fb)`	affected	code_commit	—
`[2935e556850e9c94d7a00adf14d3cd7fe406ac03,c3f63610bceaa182e4683b23cc47baf36b5f1496)`	affected	code_commit	—
`[2935e556850e9c94d7a00adf14d3cd7fe406ac03,ee2135a14fb2a3e176149122764d293f0796b1eb)`	affected	code_commit	—
`[2935e556850e9c94d7a00adf14d3cd7fe406ac03,59eecbe2f2f38d8f3e1104bd11da97f9a2c58998)`	affected	code_commit	—
`a351ff6b8ecca4229afaa0d98042bead8de64799`	affected	code_commit	—
`f8069f34c4c976786ded97498012225af87435d7`	affected	code_commit	—
`[6.1.159,6.1.188)`	affected	semver	—
`[6.6.117,6.6.157)`	affected	semver	—
`[6.12.42,6.12.110)`	affected	semver	—
`[6.15.10,6.16)`	affected	semver	—
`[6.16.1,6.17)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.17`	affected	semver	—
`[0,6.17)`	unaffected	semver	—
`[6.1.188,7.0.0)`	unaffected	semver	—
`[6.6.157,7.0.0)`	unaffected	semver	—
`[6.12.110,7.0.0)`	unaffected	semver	—
`[6.18.52,7.0.0)`	unaffected	semver	—
`[7.2.6,8.0.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the patches for the Bluetooth mgmt null pointer dereference (commits 18fda026, 59eecbe2, bbd262d2, c3f63610, ee2135a1, f02c01cc).
If a kernel upgrade is not feasible, temporarily disable the Linux Bluetooth mgmt interface or unload the hci* kernel modules to avoid executing the vulnerable code.
Reboot the system after applying the kernel update to ensure the new kernel is loaded and active.
Actively monitor system logs and crash reports for unexpected kernel panics, and consider configuring a watchdog or automated reboot to maintain availability.

Generated by OpenCVE AI on September 25, 2026 at 10:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00206.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/18fda026a13c5abd6c1e0dfd3549f490b73378fb
https://git.kernel.org/stable/c/59eecbe2f2f38d8f3e1104bd11da97f9a2c58998
https://git.kernel.org/stable/c/bbd262d2d750b67b15a5e1008d3848309c87e7a7
https://git.kernel.org/stable/c/c3f63610bceaa182e4683b23cc47baf36b5f1496
https://git.kernel.org/stable/c/ee2135a14fb2a3e176149122764d293f0796b1eb
https://git.kernel.org/stable/c/f02c01ccd12cb2b8a290077d4c90f29a6e109b16

History

Fri, 25 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1139 CWE-476

Thu, 24 Sep 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference 'uuid_count' member of struct 'discovery_state' is assigned and read without any locks, so there is a chance of situation when uuid_count != 0, but uuids is NULL and there will be NULL pointer dereference. Possible race: 'hci_update_passive_scan_sync' 'hci_discovery_filter_clear' hdev->discovery.uuid_count = 0; <----------------------preempted-----------------------------> 'start_service_discovery' // Set uuid_count to value != 0 hdev->discovery.uuid_count = uuid_count; hdev->discovery.uuids = kmemdup(...); <----------------------preempted-----------------------------> spin_lock(&hdev->discovery.lock); kfree(hdev->discovery.uuids); hdev->discovery.uuids = NULL; spin_unlock(&hdev->discovery.lock); Now uuids == NULL and uuid_count != 0. So 'mgmt_device_found' -> 'is_filter_match' -> 'eir_has_uuids' receives non consistent discovery state, where NULL dereference of uuids happens. To fix it let's add discovery.lock around every read/write of uuid_count, uuids pair of struct members. It is also important to assign uuid_count value only after success kmemdup() allocation in start_service_discovery(), otherwise uuids is NULL, because kmemdup failed, but uuid_count is already assigned to non zero value. The following panic happens: [ ] ------------[ cut here ]------------ [ ] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ ] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP [ ] CPU: 0 PID: 15056 Comm: kworker/u9:2 [ ] Workqueue: hci0 hci_rx_work [ ] pstate: 10400009 (nzcV daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ ] pc : eir_has_uuids+0x2d8/0x590 [ ] lr : is_filter_match+0x258/0x320 ... [ ] Call trace: [ ] eir_has_uuids+0x2d8/0x590 [ ] is_filter_match+0x258/0x320 [ ] mgmt_device_found+0x5b0/0xafc [ ] process_adv_report.part.0+0x8c8/0xf14 [ ] hci_le_adv_report_evt+0x338/0x3f0 [ ] hci_le_meta_evt+0x1f0/0x4c8 [ ] hci_event_packet+0x440/0xc9c [ ] hci_rx_work+0x44c/0xaf8 [ ] process_one_work+0x54c/0x103c [ ] worker_thread+0x6c4/0x10c4 [ ] kthread+0x274/0x2ec [ ] ret_from_fork+0x10/0x20 [ ] Code: 14000004 91004021 eb14003f 54000180 (f9400024) [ ] ---[ end trace 0000000000000000 ]---
Title		Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/18fda026a13c5abd6c1e0dfd3549f490b73378fb https://git.kernel.org/stable/c/59eecbe2f2f38d8f3e1104bd11da97f9a2c58998 https://git.kernel.org/stable/c/bbd262d2d750b67b15a5e1008d3848309c87e7a7 https://git.kernel.org/stable/c/c3f63610bceaa182e4683b23cc47baf36b5f1496 https://git.kernel.org/stable/c/ee2135a14fb2a3e176149122764d293f0796b1eb https://git.kernel.org/stable/c/f02c01ccd12cb2b8a290077d4c90f29a6e109b16

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-24T15:51:04.897Z

Updated: 2026-09-24T15:51:04.897Z

Reserved: 2026-09-17T16:02:15.096Z

Link: CVE-2026-93247

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-24T16:17:20.803

Modified: 2026-09-24T16:17:20.803

Link: CVE-2026-93247

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-25T10:30:10Z

Weaknesses

CWE-1139
CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object