Bluetooth: btusb: Fix UAF of btusb_data by rx_work (CVE-2026-97977) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-97977

Bluetooth: btusb: Fix UAF of btusb_data by rx_work

Answer in brief

CVE-2026-97977 records a Unknown severity vulnerability in Bluetooth: btusb: Fix UAF of btusb_data by rx_work. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 25, 2026Updated Sep 25, 2026Source checked Sep 25, 2026First seen by HOL Sep 25, 2026Material review Sep 25, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=800fe5ec302e1ebbf5e3f891f886deecd49c7132 <472d005622525b7be155cac99dde2252b0163bd1 \|\| >=800fe5ec302e1ebbf5e3f891f886deecd49c7132 <93b59937bda3fffc6386c79f5544a39bc680c8e8 \|\| >=800fe5ec302e1ebbf5e3f891f886deecd49c7132 <fa391adb9c755515a89993634745e9079e5ef37c \|\| >=800fe5ec302e1ebbf5e3f891f886deecd49c7132 <1c12c3117639e78940959d956519c758c57d0849	472d005622525b7be155cac99dde2252b0163bd1, 93b59937bda3fffc6386c79f5544a39bc680c8e8, fa391adb9c755515a89993634745e9079e5ef37c, 1c12c3117639e78940959d956519c758c57d0849
Linux/Linuxgeneric	5.17	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 472d005622525b7be155cac99dde2252b0163bd1 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 25, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix UAF of btusb_data by rx_work btusb_close() and btusb_flush() cancel data->rx_work with the asynchronous cancel_delayed_work(), so if btusb_rx_work() is already running on another CPU it keeps running after the cancel returns. btusb_disconnect() calls hci_unregister_dev(), which invokes btusb_close(), and then frees the btusb_data. A still running btusb_rx_work() then dereferences the freed data: while ((skb = skb_dequeue(&data->acl_q))) data->recv_acl(data->hdev, skb); Use cancel_delayed_work_sync() instead. In btusb_close() the cancel also has to happen after btusb_stop_traffic(), otherwise an URB completion racing with the cancel can requeue the work right after it has been waited for.

Quoted source text, attributed separately from HOL analysis.