All vulnerabilities
CVE-2026-97977

Linux: Bluetooth: btusb: Fix UAF of btusb_data by rx_work

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5242050195a711e9cd6a9935f689ab6656b94a91Also 472d005622525b7be155cac99dde2252b0163bd1, 93b59937bda3fffc6386c79f5544a39bc680c8e8 and 1 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 5242050195a711e9cd6a9935f689ab6656b94a91LinuxCVE List
  • 472d005622525b7be155cac99dde2252b0163bd1LinuxCVE List
  • 93b59937bda3fffc6386c79f5544a39bc680c8e8LinuxCVE List
  • 1c12c3117639e78940959d956519c758c57d0849LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: Fix UAF of btusb_data by rx_work

btusb_close() and btusb_flush() cancel data->rx_work with the asynchronous cancel_delayed_work(), so if btusb_rx_work() is already running on another CPU it keeps running after the cancel returns.

btusb_disconnect() calls hci_unregister_dev(), which invokes btusb_close(), and then frees the btusb_data. A still running btusb_rx_work() then dereferences the freed data:

while ((skb = skb_dequeue(&data->acl_q))) data->recv_acl(data->hdev, skb);

Use cancel_delayed_work_sync() instead. In btusb_close() the cancel also has to happen after btusb_stop_traffic(), otherwise an URB completion racing with the cancel can requeue the work right after it has been waited for.

Text from CVE List

Affected versions 14

  • Linuxaffected: 800fe5ec302e1ebbf5e3f891f886deecd49c7132 before fc654a72a8d979db15e2773a481e931abaf5a9e8CVE List
  • Linuxaffected: 800fe5ec302e1ebbf5e3f891f886deecd49c7132 before 5242050195a711e9cd6a9935f689ab6656b94a91CVE List
  • Linuxaffected: 800fe5ec302e1ebbf5e3f891f886deecd49c7132 before 472d005622525b7be155cac99dde2252b0163bd1CVE List
  • Linuxaffected: 800fe5ec302e1ebbf5e3f891f886deecd49c7132 before 93b59937bda3fffc6386c79f5544a39bc680c8e8CVE List
  • Linuxaffected: 800fe5ec302e1ebbf5e3f891f886deecd49c7132 before fa391adb9c755515a89993634745e9079e5ef37cCVE List
  • Linuxaffected: 800fe5ec302e1ebbf5e3f891f886deecd49c7132 before 1c12c3117639e78940959d956519c758c57d0849CVE List
  • Linuxaffected: 5.17CVE List
  • Linuxunaffected: all versions before 5.17CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6