CVE-2026-23146

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work<br /> <br /> hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling<br /> hci_uart_register_dev(), which calls proto-&gt;open() to initialize<br /> hu-&gt;priv. However, if a TTY write wakeup occurs during this window,<br /> hci_uart_tx_wakeup() may schedule write_work before hu-&gt;priv is<br /> initialized, leading to a NULL pointer dereference in<br /> hci_uart_write_work() when proto-&gt;dequeue() accesses hu-&gt;priv.<br /> <br /> The race condition is:<br /> <br /> CPU0 CPU1<br /> ---- ----<br /> hci_uart_set_proto()<br /> set_bit(HCI_UART_PROTO_INIT)<br /> hci_uart_register_dev()<br /> tty write wakeup<br /> hci_uart_tty_wakeup()<br /> hci_uart_tx_wakeup()<br /> schedule_work(&amp;hu-&gt;write_work)<br /> proto-&gt;open(hu)<br /> // initializes hu-&gt;priv<br /> hci_uart_write_work()<br /> hci_uart_dequeue()<br /> proto-&gt;dequeue(hu)<br /> // accesses hu-&gt;priv (NULL!)<br /> <br /> Fix this by moving set_bit(HCI_UART_PROTO_INIT) after proto-&gt;open()<br /> succeeds, ensuring hu-&gt;priv is initialized before any work can be<br /> scheduled.