CVE-2026-23146

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hciuart: fix null-ptr-deref in hciuartwritework

hciuartsetproto() sets HCIUARTPROTOINIT before calling hciuartregisterdev(), which calls proto->open() to initialize hu->priv. However, if a TTY write wakeup occurs during this window, hciuarttxwakeup() may schedule writework before hu->priv is initialized, leading to a NULL pointer dereference in hciuartwritework() when proto->dequeue() accesses hu->priv.

The race condition is:

CPU0 CPU1 ---- ---- hciuartsetproto() setbit(HCIUARTPROTOINIT) hciuartregisterdev() tty write wakeup hciuartttywakeup() hciuarttxwakeup() schedulework(&hu->writework) proto->open(hu) // initializes hu->priv hciuartwritework() hciuart_dequeue() proto->dequeue(hu) // accesses hu->priv (NULL!)

Fix this by moving setbit(HCIUARTPROTOINIT) after proto->open() succeeds, ensuring hu->priv is initialized before any work can be scheduled.