CVE-2026-97977
Received Received - Intake

Bluetooth Use-After-Free in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix UAF of btusb_data by rx_work btusb_close() and btusb_flush() cancel data->rx_work with the asynchronous cancel_delayed_work(), so if btusb_rx_work() is already running on another CPU it keeps running after the cancel returns. btusb_disconnect() calls hci_unregister_dev(), which invokes btusb_close(), and then frees the btusb_data. A still running btusb_rx_work() then dereferences the freed data: while ((skb = skb_dequeue(&data->acl_q))) data->recv_acl(data->hdev, skb); Use cancel_delayed_work_sync() instead. In btusb_close() the cancel also has to happen after btusb_stop_traffic(), otherwise an URB completion racing with the cancel can requeue the work right after it has been waited for.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97977
EUVD
EUVD-2026-86631

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's Bluetooth USB driver (btusb). It occurs when btusb_close() and btusb_flush() cancel a delayed work item (rx_work) asynchronously. If the work item is already running on another CPU, it continues after the cancel, leading to a use-after-free when btusb_disconnect() frees the btusb_data structure while btusb_rx_work() is still accessing it.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and does not have a direct network detection method. To check if your system is affected, verify the kernel version and whether the vulnerable code path exists. Use commands like 'uname -a' to check the kernel version and 'dmesg | grep btusb' to inspect Bluetooth-related logs for errors.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service (system crash) or potentially execute arbitrary code with kernel privileges. It affects systems using Bluetooth USB adapters with vulnerable Linux kernel versions.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the vulnerability. If an update is not immediately available, disable Bluetooth functionality temporarily by unloading the btusb module with 'sudo modprobe -r btusb' or blacklisting it. Monitor kernel security advisories for patches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97977. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart