CVE-2026-97977

Bluetooth: btusb: Fix UAF of btusb_data by rx_work

Published Sep 25, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: Fix UAF of btusb_data by rx_work

btusb_close() and btusb_flush() cancel data->rx_work with the
asynchronous cancel_delayed_work(), so if btusb_rx_work() is already
running on another CPU it keeps running after the cancel returns.

btusb_disconnect() calls hci_unregister_dev(), which invokes
btusb_close(), and then frees the btusb_data. A still running
btusb_rx_work() then dereferences the freed data:

while ((skb = skb_dequeue(&data->acl_q)))
data->recv_acl(data->hdev, skb);

Use cancel_delayed_work_sync() instead. In btusb_close() the cancel also
has to happen after btusb_stop_traffic(), otherwise an URB completion
racing with the cancel can requeue the work right after it has been
waited for.

Analysis

Technical impact

In the Linux kernel btusb driver a use‑after‑free can occur when a USB Bluetooth device is disconnected while its receive work is still running. Disconnecting frees the btusb_data structure, yet the pending rx_work continues to execute and dereferences the freed memory, resulting in a kernel crash or, if an attacker can influence the contents of that memory before it is reused, arbitrary code execution with kernel privileges.

Affected Systems

All Linux kernel distributions that ship the btusb driver before the patch commit (1c12c3117639e789) are affected. The flaw applies to any host that loads the btusb module to service a USB Bluetooth adapter, regardless of vendor.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score of <1% shows a low exploitation probability and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need local access to a system with a USB Bluetooth adapter and the ability to trigger a disconnect while traffic is in flight. Exploitation would likely cause a kernel crash, and could permit privilege escalation if the attacker can control the memory reused after the free. The flaw requires local interaction and is not remotely exploitable.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`800fe5ec302e1ebbf5e3f891f886deecd49c7132`	affected	< fc654a72a8d979db15e2773a481e931abaf5a9e8
`800fe5ec302e1ebbf5e3f891f886deecd49c7132`	affected	< 5242050195a711e9cd6a9935f689ab6656b94a91
`800fe5ec302e1ebbf5e3f891f886deecd49c7132`	affected	< 472d005622525b7be155cac99dde2252b0163bd1
`800fe5ec302e1ebbf5e3f891f886deecd49c7132`	affected	< 93b59937bda3fffc6386c79f5544a39bc680c8e8
`800fe5ec302e1ebbf5e3f891f886deecd49c7132`	affected	< fa391adb9c755515a89993634745e9079e5ef37c
`800fe5ec302e1ebbf5e3f891f886deecd49c7132`	affected	< 1c12c3117639e78940959d956519c758c57d0849

Linux

affected

Version	Status	Constraints
`5.17`	affected	—
`0`	unaffected	< 5.17
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[800fe5ec302e1ebbf5e3f891f886deecd49c7132,472d005622525b7be155cac99dde2252b0163bd1)`	affected	code_commit	—
`[800fe5ec302e1ebbf5e3f891f886deecd49c7132,93b59937bda3fffc6386c79f5544a39bc680c8e8)`	affected	code_commit	—
`[800fe5ec302e1ebbf5e3f891f886deecd49c7132,fa391adb9c755515a89993634745e9079e5ef37c)`	affected	code_commit	—
`[800fe5ec302e1ebbf5e3f891f886deecd49c7132,1c12c3117639e78940959d956519c758c57d0849)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.17`	affected	generic	—
`[0,5.17)`	unaffected	generic	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3-rc3,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes commit 1c12c3117639e789, which replaces cancel_delayed_work() with cancel_delayed_work_sync() and stops traffic before cancellation.
If an immediate kernel upgrade is not feasible, unload or disable the btusb module or stop the Bluetooth service to prevent use of the vulnerable driver.
As a temporary mitigation, ensure that USB Bluetooth adapters are disconnected only after confirming no active traffic; this reduces but does not eliminate the race condition.

Generated by OpenCVE AI on October 1, 2026 at 06:01 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.173% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97977.mbox
https://git.kernel.org/stable/c/1c12c3117639e78940959d956519c758c57d0849
https://git.kernel.org/stable/c/472d005622525b7be155cac99dde2252b0163bd1
https://git.kernel.org/stable/c/5242050195a711e9cd6a9935f689ab6656b94a91
https://git.kernel.org/stable/c/93b59937bda3fffc6386c79f5544a39bc680c8e8
https://git.kernel.org/stable/c/fa391adb9c755515a89993634745e9079e5ef37c
https://git.kernel.org/stable/c/fc654a72a8d979db15e2773a481e931abaf5a9e8
https://nvd.nist.gov/vuln/detail/CVE-2026-97977
https://www.cve.org/CVERecord?id=CVE-2026-97977

History

Oct 3, 2026 11:15 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/5242050195a711e9cd6a9935f689ab6656b94a91 https://git.kernel.org/stable/c/fc654a72a8d979db15e2773a481e931abaf5a9e8

Oct 1, 2026 4:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Sep 30, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97977.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-97977 https://www.cve.org/CVERecord?id=CVE-2026-97977
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 25, 2026 3:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sep 25, 2026 10:30 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix UAF of btusb_data by rx_work btusb_close() and btusb_flush() cancel data->rx_work with the asynchronous cancel_delayed_work(), so if btusb_rx_work() is already running on another CPU it keeps running after the cancel returns. btusb_disconnect() calls hci_unregister_dev(), which invokes btusb_close(), and then frees the btusb_data. A still running btusb_rx_work() then dereferences the freed data: while ((skb = skb_dequeue(&data->acl_q))) data->recv_acl(data->hdev, skb); Use cancel_delayed_work_sync() instead. In btusb_close() the cancel also has to happen after btusb_stop_traffic(), otherwise an URB completion racing with the cancel can requeue the work right after it has been waited for.
Title		Bluetooth: btusb: Fix UAF of btusb_data by rx_work
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1c12c3117639e78940959d956519c758c57d0849 https://git.kernel.org/stable/c/472d005622525b7be155cac99dde2252b0163bd1 https://git.kernel.org/stable/c/93b59937bda3fffc6386c79f5544a39bc680c8e8 https://git.kernel.org/stable/c/fa391adb9c755515a89993634745e9079e5ef37c