CVE-2026-99015 - Vulnerability Details

- Bluetooth: hci_sock: Serialize dead-device detachment

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sock: Serialize dead-device detachment

Rebinding an HCI socket after its controller is unregistered can race
monitor control replay and crash the kernel. hci_sock_bind() clears
hci_pi(sk)->hdev and drops the device reference under only the socket
lock, whereas send_monitor_control_replay() holds hci_sk_list.lock for
reading.

Replay can observe a non-NULL hdev, then bind can clear it and drop the
last reference before create_monitor_ctrl_open() reads hdev->id. This
can cause a NULL pointer dereference if the pointer is reloaded, or a
use-after-free if the old pointer is retained.

The kernel reported:

KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]
RIP: 0010:create_monitor_ctrl_open+0x579/0x800
Call Trace:
hci_sock_bind+0xd96/0x1190
__sys_bind+0x166/0x200
__x64_sys_bind+0x6d/0xb0
do_syscall_64+0xdd/0x4a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The same missing serialization lets hci_send_to_sock() select a socket
for the old device and queue its frame after bind has detached the socket
or installed a new binding.

Take hci_sk_list.lock for writing when clearing the device pointer and
resetting the socket state. This waits for existing replay and delivery
readers to finish before detachment and prevents later readers from
using the old binding. Keep hci_dev_put() outside the critical section
because the final device release can sleep.

Published: 2026-10-23

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition in the Linux kernel’s Bluetooth HCI socket implementation allows an attacker to rebind a socket after its controller is unregistered. This can cause a null pointer dereference or use‑after‑free when monitoring or monitor control replay functions access stale pointer data, leading to a kernel crash and denial of service.

Affected Systems

All Linux kernel releases that include the buggy Bluetooth hci_sock code before the patch commit are affected. The vulnerability is present in every kernel version that has not applied the serialization fix to the dead-device detachment logic. No specific version range is listed.

Risk and Exploitability

Because the flaw triggers a fatal kernel fault, the potential impact is high; EPSS score is < 1% and the vulnerability is not listed in the KEV catalog, and the CVSS score is 4.1. The attack vector appears to be a local race condition that could be triggered by an application interacting with Bluetooth sockets, possibly allowing any user with access to the system to cause a crash. Without a public exploit the likelihood is uncertain, but the severity warrants prompt mitigation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f2f856b65ac4b77049c76c0e89ecd3a177e9fcd1`	affected	< 88f47e66b1a6e0bfc350676937f3b552b434e74c
`e04480920d1eec9c061841399aa6f35b6f987d8b`	affected	< 304adbdb96b0491c2b377e216b0bf417fc8e69a9
`e04480920d1eec9c061841399aa6f35b6f987d8b`	affected	< 362126f739889436048f5573ebc87466d2525fd9
`e04480920d1eec9c061841399aa6f35b6f987d8b`	affected	< 37cef0c8fb537f40600910d2c2e5f2d5509305f3
`e04480920d1eec9c061841399aa6f35b6f987d8b`	affected	< 76f2e2665697340ac719e7ff1bf148dd014e55c1
`e04480920d1eec9c061841399aa6f35b6f987d8b`	affected	< c3d2799877906d0c8392d96e14216cd82b020330
`e04480920d1eec9c061841399aa6f35b6f987d8b`	affected	< e660a22402944f2615a16fde7129a3c497537329
`e04480920d1eec9c061841399aa6f35b6f987d8b`	affected	< 381a0925c556a8d91a80a9b9e3e86651d60ffee3
`d6ef8bb00aa65eceb413fc165a55086459863e38`	affected	—
`0e77f979a97d3d517fad0b51249ba6fb8ae2d365`	affected	—
`0782c8c7f80c9dd457acdfe16fd0f339f0e73093`	affected	—
`3719acc161d5c1ce09912cc1c9eddc2c5faa3c66`	affected	—
`ff29fe26ab8679bc13a3f0bf5b2911535a1cfc35`	affected	—
`75dd00b755ebfa9b24eaedc9f42e9adfc00ae00c`	affected	—
`5.10.58`	affected	< 5.10.273
`4.4.281`	affected	< 4.5
`4.9.280`	affected	< 4.10
`4.14.244`	affected	< 4.15
`4.19.203`	affected	< 4.20
`5.4.140`	affected	< 5.5
`5.13.10`	affected	< 5.14

Linux

affected

Version	Status	Constraints
`5.14`	affected	—
`0`	unaffected	< 5.14
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[e04480920d1eec9c061841399aa6f35b6f987d8b,37cef0c8fb537f40600910d2c2e5f2d5509305f3)`	affected	code_commit	—
`[e04480920d1eec9c061841399aa6f35b6f987d8b,76f2e2665697340ac719e7ff1bf148dd014e55c1)`	affected	code_commit	—
`[e04480920d1eec9c061841399aa6f35b6f987d8b,c3d2799877906d0c8392d96e14216cd82b020330)`	affected	code_commit	—
`[e04480920d1eec9c061841399aa6f35b6f987d8b,e660a22402944f2615a16fde7129a3c497537329)`	affected	code_commit	—
`[e04480920d1eec9c061841399aa6f35b6f987d8b,381a0925c556a8d91a80a9b9e3e86651d60ffee3)`	affected	code_commit	—
`[d6ef8bb00aa65eceb413fc165a55086459863e38,)`	affected	code_commit	—
`[0e77f979a97d3d517fad0b51249ba6fb8ae2d365,)`	affected	code_commit	—
`[0782c8c7f80c9dd457acdfe16fd0f339f0e73093,)`	affected	code_commit	—
`[3719acc161d5c1ce09912cc1c9eddc2c5faa3c66,)`	affected	code_commit	—
`[ff29fe26ab8679bc13a3f0bf5b2911535a1cfc35,)`	affected	code_commit	—
`[f2f856b65ac4b77049c76c0e89ecd3a177e9fcd1,)`	affected	code_commit	—
`[75dd00b755ebfa9b24eaedc9f42e9adfc00ae00c,)`	affected	code_commit	—
`[4.4.281,4.5)`	affected	generic	—
`[4.9.280,4.10)`	affected	generic	—
`[4.14.244,4.15)`	affected	generic	—
`[4.19.203,4.20)`	affected	generic	—
`[5.4.140,5.5)`	affected	generic	—
`[5.10.58,5.11)`	affected	generic	—
`[5.13.10,5.14)`	affected	generic	—

Linux

100%

Version	Status	Scheme	Platform
`5.14`	affected	generic	—
`[0,5.14)`	unaffected	generic	—
`[6.6.160,6.6.*]`	unaffected	generic	—
`[6.12.113,6.12.*]`	unaffected	generic	—
`[6.18.57,6.18.*]`	unaffected	generic	—
`[7.2.11,7.2.*]`	unaffected	generic	—
`[7.3,7.*]`	unaffected	generic	—
`[7.3,7.*]`	unaffected	generic	—
`[7.3,7.*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[e04480920d1eec9c061841399aa6f35b6f987d8b,37cef0c8fb537f40600910d2c2e5f2d5509305f3)`	affected	code_commit	—
`[e04480920d1eec9c061841399aa6f35b6f987d8b,76f2e2665697340ac719e7ff1bf148dd014e55c1)`	affected	code_commit	—
`[e04480920d1eec9c061841399aa6f35b6f987d8b,c3d2799877906d0c8392d96e14216cd82b020330)`	affected	code_commit	—
`[e04480920d1eec9c061841399aa6f35b6f987d8b,e660a22402944f2615a16fde7129a3c497537329)`	affected	code_commit	—
`[e04480920d1eec9c061841399aa6f35b6f987d8b,381a0925c556a8d91a80a9b9e3e86651d60ffee3)`	affected	code_commit	—
`[d6ef8bb00aa65eceb413fc165a55086459863e38,)`	affected	code_commit	—
`[0e77f979a97d3d517fad0b51249ba6fb8ae2d365,)`	affected	code_commit	—
`[0782c8c7f80c9dd457acdfe16fd0f339f0e73093,)`	affected	code_commit	—
`[3719acc161d5c1ce09912cc1c9eddc2c5faa3c66,)`	affected	code_commit	—
`[ff29fe26ab8679bc13a3f0bf5b2911535a1cfc35,)`	affected	code_commit	—
`[f2f856b65ac4b77049c76c0e89ecd3a177e9fcd1,)`	affected	code_commit	—
`[75dd00b755ebfa9b24eaedc9f42e9adfc00ae00c,)`	affected	code_commit	—
`[4.4.281,4.5)`	affected	generic	—
`[4.9.280,4.10)`	affected	generic	—
`[4.14.244,4.15)`	affected	generic	—
`[4.19.203,4.20)`	affected	generic	—
`[5.4.140,5.5)`	affected	generic	—
`[5.10.58,5.11)`	affected	generic	—
`[5.13.10,5.14)`	affected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`5.14`	affected	generic	—
`[0,5.14)`	unaffected	generic	—
`[6.6.160,6.6.*]`	unaffected	generic	—
`[6.12.113,6.12.*]`	unaffected	generic	—
`[6.18.57,6.18.*]`	unaffected	generic	—
`[7.2.11,7.2.*]`	unaffected	generic	—
`[7.3,7.*]`	unaffected	generic	—
`[7.3,7.*]`	unaffected	generic	—
`[7.3,7.*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the patched hci_sock serialization logic.
As a temporary precaution, disable or limit the use of Bluetooth HCI sockets in services or applications until a kernel update is applied.
Monitor system logs for KASAN messages indicating a null‑pointer dereference in hci_sock_bind or create_monitor_ctrl_open, and investigate any unexpected controller detachment events.

Generated by OpenCVE AI on October 29, 2026 at 14:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99015.mbox
https://git.kernel.org/stable/c/304adbdb96b0491c2b377e216b0bf417fc8e69a9
https://git.kernel.org/stable/c/362126f739889436048f5573ebc87466d2525fd9
https://git.kernel.org/stable/c/37cef0c8fb537f40600910d2c2e5f2d5509305f3
https://git.kernel.org/stable/c/381a0925c556a8d91a80a9b9e3e86651d60ffee3
https://git.kernel.org/stable/c/76f2e2665697340ac719e7ff1bf148dd014e55c1
https://git.kernel.org/stable/c/88f47e66b1a6e0bfc350676937f3b552b434e74c
https://git.kernel.org/stable/c/c3d2799877906d0c8392d96e14216cd82b020330
https://git.kernel.org/stable/c/e660a22402944f2615a16fde7129a3c497537329
https://nvd.nist.gov/vuln/detail/CVE-2026-99015
https://www.cve.org/CVERecord?id=CVE-2026-99015

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/304adbdb96b0491c2b377e216b0bf417fc8e69a9 https://git.kernel.org/stable/c/362126f739889436048f5573ebc87466d2525fd9 https://git.kernel.org/stable/c/88f47e66b1a6e0bfc350676937f3b552b434e74c

Thu, 29 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99015.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99015 https://www.cve.org/CVERecord?id=CVE-2026-99015
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 15:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416 CWE-476

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hci_sock_bind() clears hci_pi(sk)->hdev and drops the device reference under only the socket lock, whereas send_monitor_control_replay() holds hci_sk_list.lock for reading. Replay can observe a non-NULL hdev, then bind can clear it and drop the last reference before create_monitor_ctrl_open() reads hdev->id. This can cause a NULL pointer dereference if the pointer is reloaded, or a use-after-free if the old pointer is retained. The kernel reported: KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] RIP: 0010:create_monitor_ctrl_open+0x579/0x800 Call Trace: hci_sock_bind+0xd96/0x1190 __sys_bind+0x166/0x200 __x64_sys_bind+0x6d/0xb0 do_syscall_64+0xdd/0x4a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f The same missing serialization lets hci_send_to_sock() select a socket for the old device and queue its frame after bind has detached the socket or installed a new binding. Take hci_sk_list.lock for writing when clearing the device pointer and resetting the socket state. This waits for existing replay and delivery readers to finish before detachment and prevents later readers from using the old binding. Keep hci_dev_put() outside the critical section because the final device release can sleep.
Title		Bluetooth: hci_sock: Serialize dead-device detachment
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/37cef0c8fb537f40600910d2c2e5f2d5509305f3 https://git.kernel.org/stable/c/381a0925c556a8d91a80a9b9e3e86651d60ffee3 https://git.kernel.org/stable/c/76f2e2665697340ac719e7ff1bf148dd014e55c1 https://git.kernel.org/stable/c/c3d2799877906d0c8392d96e14216cd82b020330 https://git.kernel.org/stable/c/e660a22402944f2615a16fde7129a3c497537329

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:20:41.608Z

Updated: 2026-10-30T12:40:57.696Z

Reserved: 2026-09-25T10:25:14.385Z

Link: CVE-2026-99015

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:24.270

Modified: 2026-10-30T13:21:37.487

Link: CVE-2026-99015

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-99015 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-29T14:45:14Z

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-416
Use After Free
CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object