{"id":"CVE-2026-99015","kind":"vulnerability","aliases":["CVE-2026-99015"],"related":[],"title":"Linux kernel: Bluetooth HCI socket rebind race crashes the system","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sock: Serialize dead-device detachment\n\nRebinding an HCI socket after its controller is unregistered can race\nmonitor control replay and crash the kernel. hci_sock_bind() clears\nhci_pi(sk)->hdev and drops the device reference under only the socket\nlock, whereas send_monitor_control_replay() holds hci_sk_list.lock for\nreading.\n\nReplay can observe a non-NULL hdev, then bind can clear it and drop the\nlast reference before create_monitor_ctrl_open() reads hdev->id. This\ncan cause a NULL pointer dereference if the pointer is reloaded, or a\nuse-after-free if the old pointer is retained.\n\nThe kernel reported:\n\n  KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]\n  RIP: 0010:create_monitor_ctrl_open+0x579/0x800\n  Call Trace:\n   hci_sock_bind+0xd96/0x1190\n   __sys_bind+0x166/0x200\n   __x64_sys_bind+0x6d/0xb0\n   do_syscall_64+0xdd/0x4a0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe same missing serialization lets hci_send_to_sock() select a socket\nfor the old device and queue its frame after bind has detached the socket\nor installed a new binding.\n\nTake hci_sk_list.lock for writing when clearing the device pointer and\nresetting the socket state. This waits for existing replay and delivery\nreaders to finish before detachment and prevents later readers from\nusing the old binding. Keep hci_dev_put() outside the critical section\nbecause the final device release can sleep.","summary":"Rebinding a Bluetooth HCI socket after its controller is unregistered can race monitor control replay and crash the kernel with a NULL pointer dereference or use-after-free. The sources do not say what an attacker can gain beyond a crash.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","kernel","linux","runtime"],"not_affected_if":["bluetooth-disabled"],"how_to_check":"- `uname -r` to see the running kernel version\n- `grep -i bluetooth /proc/modules` to see whether the Bluetooth stack is loaded\n- Compare the kernel version against the fixed release in the upstream commit listed by NVD","fix":"- Update the Linux kernel to a release that includes the upstream fix (serialization of dead-device detachment in hci_sock, using hci_sk_list.lock for writing)\n- Unknown fixed version numbers: the sources do not say","status":"open","published_at":"2026-10-23T13:17:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:55:44+00:00","updated_at":"2026-10-25T04:55:44+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:55:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix (serialization of dead-device detachment in hci_sock, using hci_sk_list.lock for writing)\n- Unknown fixed version numbers: the sources do not say","reach":"local","title":"Linux kernel: Bluetooth HCI socket rebind race crashes the system","impact":"medium","summary":"Rebinding a Bluetooth HCI socket after its controller is unregistered can race monitor control replay and crash the kernel with a NULL pointer dereference or use-after-free. The sources do not say what an attacker can gain beyond a crash.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","bluetooth"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel crash from null-pointer dereference or use-after-free during socket bind","analyst_note":"Check the NVD entry and upstream kernel commit for fixed versions, and whether an unprivileged local user can trigger the race.","how_to_check":"- `uname -r` to see the running kernel version\n- `grep -i bluetooth /proc/modules` to see whether the Bluetooth stack is loaded\n- Compare the kernel version against the fixed release in the upstream commit listed by NVD","needs_analyst":true,"not_affected_if":["bluetooth-disabled"],"who_is_affected":"Systems running a Linux kernel with the Bluetooth HCI socket code, where a local process can bind an HCI socket while a Bluetooth controller is being unregistered. Systems with Bluetooth disabled or the module not loaded are unlikely to be affected, though the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000689,"input_tokens":3812,"output_tokens":616,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':195C,202C,206C,211C,216C,223C '-2026':12A,15A '-99015':13A,16A '0010':190C '0x0000000000000068':187C '0x0000000000000068-0x000000000000006f':186C '0x000000000000006f':188C '64':215C,220C 'attack':57B 'beyond':60B 'bind':101C,135C,201C,205C,210C,246C,255C,290C 'bluetooth':3A,17B,23B,73C 'call':197C 'caus':154C 'clear':102C,137C,261C 'control':28B,34B,87C,93C,120C 'crash':8A,37B,62B,96C 'creat':145C,191C 'critic':297C 'ctrl':147C,193C 'cve':11A,14A 'dead':78C 'dead-devic':77C 'deliveri':276C 'deref':183C 'derefer':44B,158C 'detach':80C,248C,281C 'dev':293C 'devic':79C,110C,240C,263C,302C 'drop':108C,140C 'entri':218C 'exist':273C 'final':301C 'finish':279C 'follow':68C 'frame':244C 'free':49B,169C 'gain':59B 'hci':4A,24B,74C,83C,99C,103C,199C,230C,292C 'hci_sk_list.lock':123C,257C 'hdev':106C,133C,150C 'hold':122C 'hwframe':222C 'id':151C 'instal':252C 'kasan':179C 'keep':291C 'kernel':2A,18B,39B,66C,98C,177C 'last':142C 'later':284C 'let':229C 'linux':1A,19B,65C 'lock':116C 'miss':227C 'monitor':33B,92C,119C,146C,192C 'new':254C 'non':131C 'non-nul':130C 'null':42B,132C,156C,181C 'null-ptr-deref':180C 'observ':128C 'old':172C,239C,289C 'open':148C,194C 'outsid':295C 'pi':104C 'pointer':43B,157C,161C,173C,264C 'prevent':283C 'ptr':182C 'put':294C 'queue':242C 'race':7A,32B,91C 'rang':185C 'read':125C,149C 'reader':277C,285C 'rebind':6A,21B,81C 'refer':111C,143C 'releas':303C 'reload':163C 'replay':35B,94C,121C,126C,274C 'report':178C 'reset':266C 'resolv':72C 'retain':175C 'rip':189C 'runtim':20B 'say':54B 'section':298C 'select':234C 'send':118C,231C 'serial':76C,228C 'sk':105C 'sleep':305C 'sock':75C,100C,200C,233C 'socket':5A,25B,84C,115C,236C,250C,268C 'sourc':51B 'state':269C 'sys':204C,209C 'syscal':214C,219C 'system':10A 'take':256C 'trace':198C 'unregist':30B,89C 'use':47B,167C,287C 'use-after-fre':46B,166C 'vulner':69C 'wait':271C 'wherea':117C 'write':259C 'x166/0x200':207C 'x579/0x800':196C 'x64':208C 'x6d/0xb0':212C 'x77/0x7f':224C 'xd96/0x1190':203C 'xdd/0x4a0':217C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Bluetooth HCI socket code, where a local process can bind an HCI socket while a Bluetooth controller is being unregistered. Systems with Bluetooth disabled or the module not loaded are unlikely to be affected, though the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99015","severity":null,"published_at":"2026-10-23T13:17:24+00:00","modified_at":"2026-10-23T13:17:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}