Към съдържанието
Търсене

CVE-2026-97908: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq->hdev without taking an hci_dev reference. The current teardown order frees the hci_dev before destroying the RPMsg endpoints in both the hci_register_dev() error path and the driver remove path. If WCNSS delivers data in that window, the endpoint callback can run with an already freed hci_dev and pass it to the Bluetooth core. For qcom_smd endpoints, rpmsg_destroy_ept() closes the channel and clears the callback under the channel recv_lock. The receive path holds the same lock while invoking the callback, so destroying the endpoints first both prevents new callbacks and serializes with any callback already running. Destroy the command and ACL endpoints before hci_free_dev(). Keep hci_unregister_dev() first during remove so the HCI core stops issuing operations before the transport endpoints are shut down. In the full registration-error cleanup path, return directly after freeing the hci_dev to avoid falling through to the partial-construction labels and destroying the endpoints twice.

    Засегнати продукти

    • Linux Linux: 5052de8deff5619a9b7071f00084fd0264b58e17 преди b9b34cc149f8344d1cffbf318eb1c8cb414f74ac; 5052de8deff5619a9b7071f00084fd0264b58e17 преди e2a0d9401368ec29bd0cdbfe9545d2a800429875; 5052de8deff5619a9b7071f00084fd0264b58e17 преди f5e4f81f4e075cd5ec062f81b576b88cdee998d1; 5052de8deff5619a9b7071f00084fd0264b58e17 преди aaa7f676418e1eb2c4ef0d4e4b07812b25e7b404; 5052de8deff5619a9b7071f00084fd0264b58e17 преди 962dcc1d8a52e64428cae07806e7f6b8d3ec6ac0; 5052de8deff5619a9b7071f00084fd0264b58e17 преди 2dcc2240b4e5f6e5dce1736f82666aba40eb3b13; 5052de8deff5619a9b7071f00084fd0264b58e17 преди 2d016208a011558f211ec9687889df8318654730; 5052de8deff5619a9b7071f00084fd0264b58e17 преди f5a427b16e45210dee656b0860728f3d496dee85
    • Linux Linux: 4.12; преди 4.12; 5.10.273 до 5.10.*; 5.15.224 до 5.15.*; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.111 до 6.12.*; 6.18.53 до 6.18.*; 7.2.7 до 7.2.*; от 7.3 нататък

    История

    • 25 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-97908: Linux | freedomonline.bg