CVE-2026-97908 - Vulnerability Details

- Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev

The command and ACL RPMsg endpoints store struct btqcomsmd as their
callback private data. The receive callbacks dereference btq->hdev
without taking an hci_dev reference.

The current teardown order frees the hci_dev before destroying the RPMsg
endpoints in both the hci_register_dev() error path and the driver remove
path. If WCNSS delivers data in that window, the endpoint callback can
run with an already freed hci_dev and pass it to the Bluetooth core.

For qcom_smd endpoints, rpmsg_destroy_ept() closes the channel and clears
the callback under the channel recv_lock. The receive path holds the same
lock while invoking the callback, so destroying the endpoints first both
prevents new callbacks and serializes with any callback already running.

Destroy the command and ACL endpoints before hci_free_dev(). Keep
hci_unregister_dev() first during remove so the HCI core stops issuing
operations before the transport endpoints are shut down. In the full
registration-error cleanup path, return directly after freeing the hci_dev
to avoid falling through to the partial-construction labels and destroying
the endpoints twice.

Published: 2026-09-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A defect in the Linux kernel Bluetooth driver allows the hci_dev to be freed before the RPMsg endpoints are destroyed. This leads to a use‑after‑free condition where the callback associated with the endpoint can dereference a pointer to an already freed hci_dev. An attacker who can trigger the endpoint callback during teardown could potentially corrupt memory, crash the kernel, or gain elevated privileges. The weakness corresponds to a classic use‑after‑free flaw.

Affected Systems

The vulnerability affects the Linux kernel, specifically the btqcomsmd component of the Bluetooth subsystem. No specific kernel version is listed in the available data, so any kernel installation that includes this driver and the described teardown order may be impacted.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate impact. The EPSS score is <1%, implying a very low current exploitation probability. The vulnerability is not listed in CISA KEV. The flaw requires an attacker to trigger the RPMsg endpoint callback while the driver is tearing down, typically by delivering data via WCNSS during shutdown or a driver error path. Successful exploitation could lead to memory corruption or kernel panic, potentially allowing local privilege escalation or kernel mode code execution.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5052de8deff5619a9b7071f00084fd0264b58e17`	affected	< 962dcc1d8a52e64428cae07806e7f6b8d3ec6ac0
`5052de8deff5619a9b7071f00084fd0264b58e17`	affected	< 2dcc2240b4e5f6e5dce1736f82666aba40eb3b13
`5052de8deff5619a9b7071f00084fd0264b58e17`	affected	< 2d016208a011558f211ec9687889df8318654730
`5052de8deff5619a9b7071f00084fd0264b58e17`	affected	< f5a427b16e45210dee656b0860728f3d496dee85

Linux

affected

Version	Status	Constraints
`4.12`	affected	—
`0`	unaffected	< 4.12
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5052de8deff5619a9b7071f00084fd0264b58e17,962dcc1d8a52e64428cae07806e7f6b8d3ec6ac0)`	affected	generic	—
`[5052de8deff5619a9b7071f00084fd0264b58e17,2dcc2240b4e5f6e5dce1736f82666aba40eb3b13)`	affected	generic	—
`[5052de8deff5619a9b7071f00084fd0264b58e17,2d016208a011558f211ec9687889df8318654730)`	affected	generic	—
`[5052de8deff5619a9b7071f00084fd0264b58e17,f5a427b16e45210dee656b0860728f3d496dee85)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.12`	affected	generic	—
`[0,4.12)`	unaffected	generic	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3-rc3,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that ensures RPMsg endpoints are destroyed before freeing the hci_dev.
Reboot the system after applying the patch to load the driver with the correct teardown order.
If the patch is not yet available, disable the Bluetooth subsystem or prevent WCNSS from sending data during driver teardown, for example by temporarily unloading the netlink or disabling the device, to mitigate the use‑after‑free until a fix is applied.

Generated by OpenCVE AI on October 1, 2026 at 05:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97908.mbox
https://git.kernel.org/stable/c/2d016208a011558f211ec9687889df8318654730
https://git.kernel.org/stable/c/2dcc2240b4e5f6e5dce1736f82666aba40eb3b13
https://git.kernel.org/stable/c/962dcc1d8a52e64428cae07806e7f6b8d3ec6ac0
https://git.kernel.org/stable/c/f5a427b16e45210dee656b0860728f3d496dee85
https://nvd.nist.gov/vuln/detail/CVE-2026-97908
https://www.cve.org/CVERecord?id=CVE-2026-97908

History

Wed, 30 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97908.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-97908 https://www.cve.org/CVERecord?id=CVE-2026-97908
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 25 Sep 2026 21:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 25 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq->hdev without taking an hci_dev reference. The current teardown order frees the hci_dev before destroying the RPMsg endpoints in both the hci_register_dev() error path and the driver remove path. If WCNSS delivers data in that window, the endpoint callback can run with an already freed hci_dev and pass it to the Bluetooth core. For qcom_smd endpoints, rpmsg_destroy_ept() closes the channel and clears the callback under the channel recv_lock. The receive path holds the same lock while invoking the callback, so destroying the endpoints first both prevents new callbacks and serializes with any callback already running. Destroy the command and ACL endpoints before hci_free_dev(). Keep hci_unregister_dev() first during remove so the HCI core stops issuing operations before the transport endpoints are shut down. In the full registration-error cleanup path, return directly after freeing the hci_dev to avoid falling through to the partial-construction labels and destroying the endpoints twice.
Title		Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2d016208a011558f211ec9687889df8318654730 https://git.kernel.org/stable/c/2dcc2240b4e5f6e5dce1736f82666aba40eb3b13 https://git.kernel.org/stable/c/962dcc1d8a52e64428cae07806e7f6b8d3ec6ac0 https://git.kernel.org/stable/c/f5a427b16e45210dee656b0860728f3d496dee85

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:22:32.837Z

Updated: 2026-09-25T10:22:32.837Z

Reserved: 2026-09-25T10:18:58.200Z

Link: CVE-2026-97908

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-25T11:17:17.730

Modified: 2026-09-25T11:17:17.730

Link: CVE-2026-97908

Redhat

Severity : Moderate

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-97908 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-01T05:45:17Z

Weaknesses

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object