CVE-2026-23146
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling hci_uart_register_dev(), which calls proto->open() to initialize hu->priv. However, if a TTY write wakeup occurs during this window, hci_uart_tx_wakeup() may schedule write_work before hu->priv is initialized, leading to a NULL pointer dereference in hci_uart_write_work() when proto->dequeue() accesses hu->priv. The race condition is: CPU0 CPU1 ---- ---- hci_uart_set_proto() set_bit(HCI_UART_PROTO_INIT) hci_uart_register_dev() tty write wakeup hci_uart_tty_wakeup() hci_uart_tx_wakeup() schedule_work(&hu->write_work) proto->open(hu) // initializes hu->priv hci_uart_write_work() hci_uart_dequeue() proto->dequeue(hu) // accesses hu->priv (NULL!) Fix this by moving set_bit(HCI_UART_PROTO_INIT) after proto->open() succeeds, ensuring hu->priv is initialized before any work can be scheduled.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| a40f94f7caa8d3421b64f63ac31bc0f24c890f39 | affected | git | b0a900939e7e4866d9b90e9112514b72c451e873 | Unavailable | None listed |
| 9e5a0f5777162e503400c70c6ed25fbbe2d38799 | affected | git | ccc683f597ceb28deb966427ae948e5ac739a909 | Unavailable | None listed |
| 80f14e9de6a43a0bd8194cad1003a3e6dcbc3984 | affected | git | 937a573423ce5a96fdb1fd425dc6b8d8d4ab5779 | Unavailable | None listed |
| 02e1bcdfdf769974e7e9fa285e295cd9852e2a38 | affected | git | 186d147cf7689ba1f9b3ddb753ab634a84940cc9 | Unavailable | None listed |
| 281782d2c6730241e300d630bb9f200d831ede71 | affected | git | 53e54cb31e667fca05b1808b990eac0807d1dab0 | Unavailable | None listed |
| 5df5dafc171b90d0b8d51547a82657cd5a1986c7 | affected | git | 03e8c90c62233382042b7bd0fa8b8900552fdb62 | Unavailable | None listed |
| 5df5dafc171b90d0b8d51547a82657cd5a1986c7 | affected | git | 0c3cd7a0b862c37acbee6d9502107146cc944398 | Unavailable | None listed |
| 1dcf08fcff5ca529de6dc0395091f28854f4e54a | affected | git | Unavailable | Unavailable | None listed |
| 8e5aff600539e5faea294d9612cca50220e602b8 | affected | git | Unavailable | Unavailable | None listed |
| db7509fa110dd9b11134b75894677f30353b2c51 | affected | git | Unavailable | Unavailable | None listed |
| 5.10.237 | affected | semver | 5.10.249 | Unavailable | None listed |
| 5.15.181 | affected | semver | 5.15.199 | Unavailable | None listed |
| 6.1.135 | affected | semver | 6.1.162 | Unavailable | None listed |
| 6.6.88 | affected | semver | 6.6.123 | Unavailable | None listed |
| 6.12.24 | affected | semver | 6.12.69 | Unavailable | None listed |
| 5.4.293 | affected | semver | 5.5 | Unavailable | None listed |
| 6.13.12 | affected | semver | 6.14 | Unavailable | None listed |
| 6.14.3 | affected | semver | 6.15 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 6.15 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 6.15 | Unavailable | None listed |
| 5.10.249 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.199 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.162 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.123 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.69 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.9 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 6.19 | unaffected | original_commit_for_fix | Unavailable | * | None listed |