CVE-2026-97908

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev

The command and ACL RPMsg endpoints store struct btqcomsmd as their

callback private data. The receive callbacks dereference btq->hdev

without taking an hci_dev reference.

The current teardown order frees the hci_dev before destroying the RPMsg

endpoints in both the hci_register_dev() error path and the driver remove

path. If WCNSS delivers data in that window, the endpoint callback can

run with an already freed hci_dev and pass it to the Bluetooth core.

For qcom_smd endpoints, rpmsg_destroy_ept() closes the channel and clears

the callback under the channel recv_lock. The receive path holds the same

lock while invoking the callback, so destroying the endpoints first both

prevents new callbacks and serializes with any callback already running.

Destroy the command and ACL endpoints before hci_free_dev(). Keep

hci_unregister_dev() first during remov

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References