In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hciuart: fix null-ptr-deref in hciuartwritework
hciuartsetproto() sets HCIUARTPROTOINIT before calling hciuartregisterdev(), which calls proto->open() to initialize hu->priv. However, if a TTY write wakeup occurs during this window, hciuarttxwakeup() may schedule writework before hu->priv is initialized, leading to a NULL pointer dereference in hciuartwritework() when proto->dequeue() accesses hu->priv.
The race condition is:
CPU0 CPU1 ---- ---- hciuartsetproto() setbit(HCIUARTPROTOINIT) hciuartregisterdev() tty write wakeup hciuartttywakeup() hciuarttxwakeup() schedulework(&hu->writework) proto->open(hu) // initializes hu->priv hciuartwritework() hciuart_dequeue() proto->dequeue(hu) // accesses hu->priv (NULL!)
Fix this by moving setbit(HCIUARTPROTOINIT) after proto->open() succeeds, ensuring hu->priv is initialized before any work can be scheduled.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23146.json"
}