Cloudanix VulnDB

CVE-2026-99015

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing bug in the Linux kernel's Bluetooth handling can make the whole system crash when certain local operations overlap.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in Linux kernel Bluetooth HCI socket code allows hci_sock_bind to clear hdev pointer under only socket lock while send_monitor_control_replay holds hci_sk_list.lock for read, enabling NULL pointer dereference or use-after-free in create_monitor_ctrl_open and hci_send_to_sock.

Why it matters to the business

Local denial-of-service via kernel panic on systems exposing Bluetooth HCI sockets; no remote vector and low exploit maturity limit widespread impact, but unpatched kernels remain exposed to local attackers.

How an attack unfolds

A local attacker triggers rapid HCI socket bind/unbind sequences after controller unregistration, racing monitor control replay to observe a stale or cleared hdev pointer, resulting in a crash during frame delivery or control open operations.

How to fix it

Apply the upstream fix that takes hci_sk_list.lock for writing during device pointer clearance and state reset; rebuild and deploy the patched kernel across all affected Linux distributions.

How to confirm the fix worked

Confirm presence of the serialization change in hci_sock.c around hci_sock_bind and send_monitor_control_replay; run targeted bind/replay stress tests and verify absence of KASAN null-ptr-deref reports.

Typical attack path

  1. Obtain local shell or process with capability to bind HCI sockets
  2. Unregister or trigger detachment of Bluetooth controller
  3. Concurrently perform socket bind while monitor replay runs
  4. Trigger NULL dereference or UAF in create_monitor_ctrl_open or hci_send_to_sock
  5. Cause kernel panic

How to detect it

Search kernel logs and crash dumps for KASAN null-ptr-deref reports, the RIP create_monitor_ctrl_open+0x579, and call traces containing hci_sock_bind and __sys_bind; correlate with recent Bluetooth controller detach events.

  • KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]
  • RIP: 0010:create_monitor_ctrl_open+0x579/0x800
  • Call Trace: hci_sock_bind+0xd96/0x1190
  • hci_sk_list.lock

What your security team should do

  • Prioritize patching kernel packages on any system with Bluetooth enabled or HCI socket access
  • Restrict unprivileged local users from binding HCI sockets via LSM or capabilities where possible
  • Monitor for kernel oops and KASAN reports matching the described stack trace

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hci_sock_bind() clears hci_pi(sk)->hdev and drops the device reference under only the socket lock, whereas send_monitor_control_replay() holds hci_sk_list.lock for reading. Replay can observe a non-NULL hdev, then bind can clear it and drop the last reference before create_monitor_ctrl_open() reads hdev->id. This can cause a NULL pointer dereference if the pointer is reloaded, or a use-after-free if the old pointer is retained. The kernel reported: KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] RIP: 0010:create_monitor_ctrl_open+0x579/0x800 Call Trace: hci_sock_bind+0xd96/0x1190 __sys_bind+0x166/0x200 __x64_sys_bind+0x6d/0xb0 do_syscall_64+0xdd/0x4a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f The same missing serialization lets hci_send_to_sock() select a socket for the old device and queue its frame after bind has detached the socket or installed a new binding. Take hci_sk_list.lock for writing when clearing the device pointer and resetting the socket state. This waits for existing replay and delivery readers to finish before detachment and prevents later readers from using the old binding. Keep hci_dev_put() outside the critical section because the final device release can sleep.

Affected packages

Ecosystem Package Introduced Fixed