CVE-2026-97908 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq->hdev without taking an hci_dev reference.
The current teardown order frees the hci_dev before destroying the RPMsg endpoints in both the hci_register_dev() error path and the driver remove path. If WCNSS delivers data in that window, the endpoint callback can run with an already freed hci_dev and pass it to the Bluetooth core.
For qcom_smd endpoints, rpmsg_destroy_ept() closes the channel and clears the callback under the channel recv_lock. The receive path holds the same lock while invoking the callback, so destroying the endpoints first both prevents new callbacks and serializes with any callback already running.
Destroy the command and ACL endpoints before hci_free_dev(). Keep hci_unregister_dev() first during remove so the HCI core stops issuing operations before the transport endpoints are shut down. In the full registration-error cleanup path, return directly after freeing the hci_dev to avoid falling through to the partial-construction labels and destroying the endpoints twice.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in the Linux kernel Bluetooth subsystem specifically affects the btqcomsmd driver, which manages communication with Qualcomm-based wireless connectivity solutions via RPMsg channels. This issue represents a classic use-after-free condition arising from an incorrect teardown sequence during device initialization failure or driver removal operations. The core of the problem lies in how the command and ACL RPMsg endpoints handle their private data structures. These endpoints store a pointer to struct btqcomsmd as callback private data, which includes a reference to the underlying hci_dev structure representing the Bluetooth controller hardware interface. When incoming data is received from the WCNSS subsystem, the receive callbacks are invoked, and these functions dereference the stored btq->hdev pointer without acquiring an additional reference count or performing any validity checks on its lifecycle status.
The operational flaw stems from a race condition created by the order of resource deallocation in both the error path following hci_register_dev failures and the driver remove path during unloading. In these scenarios, the original implementation freed the hci_dev structure before destroying the RPMsg endpoints. This creates a critical window where the kernel memory containing the hci_dev may be reclaimed or repurposed while the RPMsg channel remains active and capable of receiving data from the hardware. If WCNSS delivers packets during this interval, the endpoint callback executes with a dangling pointer to an already freed object. Passing this invalid pointer back to the Bluetooth core can lead to memory corruption, kernel panics, or potentially arbitrary code execution if the attacker can influence the contents of the reclaimed memory region through other means such as heap spraying techniques.
From a technical perspective, this vulnerability is categorized under CWE-416: Use After Free, which describes situations where software continues to use a pointer after it has been freed, leading to undefined behavior and potential security breaches. The specific mechanism involves asynchronous callback execution that outlives the lifetime of the object it references due to improper synchronization during cleanup sequences. In terms of adversarial tactics, this aligns with ATT&CK techniques related to memory corruption exploitation, where an attacker might attempt to trigger the race condition by rapidly sending data or manipulating device states to force a removal or error path while maintaining active communication channels. The lack of reference counting on the hci_dev within the callback context exacerbates the risk, as there is no mechanism to keep the object alive if it is being concurrently destroyed.
The resolution implemented in this patch addresses the issue by enforcing a strict ordering constraint during resource teardown. Specifically, the command and ACL endpoints are now destroyed before calling hci_free_dev, ensuring that all pending callbacks have completed or been prevented from starting before the underlying data structure is released. For qcom_smd endpoints, rpmsg_destroy_ept() serves as the synchronization point by closing the channel and clearing the callback under the channel recv_lock. Since the receive path holds this same lock while invoking callbacks, destroying the endpoints first effectively prevents new callbacks from being scheduled and serializes with any currently running callback execution. This ensures that no further dereferences of the hci_dev will occur after it has been freed.
Additionally, the fix adjusts the sequence in the driver remove path by ensuring hci_unregister_dev is called before shutting down transport endpoints. This guarantees that the HCI core ceases issuing new operations to the device before the underlying communication channels are terminated, further reducing the window of vulnerability. In cases where registration fails after partial construction, the cleanup logic was modified to return directly after freeing the hci_dev rather than falling through to labels that might attempt to destroy endpoints twice or access freed memory incorrectly. These changes collectively eliminate the race condition and ensure robust handling of device lifecycle events in high-throughput wireless environments typical of modern mobile and IoT devices utilizing Qualcomm chipsets.