Live › vulnerability › CVE-2026-99015
Go to dashboardRebinding a Bluetooth HCI socket after its controller is unregistered can race monitor control replay and crash the kernel with a NULL pointer dereference or use-after-free. The sources do not say what an attacker can gain beyond a crash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Bluetooth HCI socket code, where a local process can bind an HCI socket while a Bluetooth controller is being unregistered. Systems with Bluetooth disabled or the module not loaded are unlikely to be affected, though the sources do not confirm this.
No product ranges from the sources yet.
uname -r to see the running kernel versiongrep -i bluetooth /proc/modules to see whether the Bluetooth stack is loadedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sock: Serialize dead-device detachment
Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hci_sock_bind() clears hci_pi(sk)->hdev and drops the device reference under only the socket lock, whereas send_monitor_control_replay() holds hci_sk_list.lock for reading.
Replay can observe a non-NULL hdev, then bind can clear it and drop the last reference before create_monitor_ctrl_open() reads hdev->id. This can cause a NULL pointer dereference if the pointer is reloaded, or a use-after-free if the old pointer is retained.
The kernel reported:
KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] RIP: 0010:create_monitor_ctrl_open+0x579/0x800 Call Trace: hci_sock_bind+0xd96/0x1190 __sys_bind+0x166/0x200 __x64_sys_bind+0x6d/0xb0 do_syscall_64+0xdd/0x4a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
The same missing serialization lets hci_send_to_sock() select a socket for the old device and queue its frame after bind has detached the socket or installed a new binding.
Take hci_sk_list.lock for writing when clearing the device pointer and resetting the socket state. This waits for existing replay and delivery readers to finish before detachment and prevents later readers from using the old binding. Keep hci_dev_put() outside the critical section because the final device release can sleep.
This page as .md · .json · in your agent: get_signal("CVE-2026-99015")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.