Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-99008— Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复：蓝牙：RFCOMM：修复 rfcomm_dev_shutdown 中的 NULL tty_dev 解引用问题 syzbot 在关闭 RFCOMM TTY 设备时，触发了函数中的空指针解引用漏洞。具体原因如下：函数会先将新设备添加到列表中，随后才注册 TTY 设备并将其保存至。如果 TTY 设备注册失败，则将始终保持为 NULL。然而，在此期间该设备仍可能被查找并打开（例如通过调用），此时会成功将该 TTY 设备绑定到该结构体上。当该 TTY 设备再次被

AI Predicted 5.5 Difficulty: Moderate EPSS 0.17% · P6 Updated Oct 23, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 12

Vendor	Product	Version Range	Status
Linux	Linux	`cad348a17e170451ea8688b532a6ca3e98c63b60< d5c372ad03330f02962d4860df4d355ab25487df`	affected
		`cad348a17e170451ea8688b532a6ca3e98c63b60< 3fd5164bdb04635caa7942ddb554b0ec699a9433`	affected
		`cad348a17e170451ea8688b532a6ca3e98c63b60< a661f401f83b8462f2d424e0a1a72b7681e92ea2`	affected
		`cad348a17e170451ea8688b532a6ca3e98c63b60< d0aef0b0374678153244f162df507106d728af39`	affected
		`cad348a17e170451ea8688b532a6ca3e98c63b60< 08e90633377f1b2567ab5ad6810b74c552246a07`	affected
		`3.12`	affected
		`< 3.12`	unaffected
		`6.6.160≤ 6.6.*`	unaffected
… +4 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown syzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an RFCOMM tty is closed. rfcomm_dev_add() puts the new device on rfcomm_dev_list first and only then registers the tty device and saves it in dev->tty_dev. If that registration fails, dev->tty_dev is never set at all. The device can be looked up in the meantime, so an open() of /dev/rfcommN gets through rfcomm_tty_install() and attaches to it. When that tty is closed again, rfcomm_dev_shutdown() uses dev->tty_dev without checking it: Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] RIP: 0010:rfcomm_dev_shutdown+0x48/0xb0 net/bluetooth/rfcomm/tty.c:131 Call Trace: tty_port_shutdown+0x1bf/0x220 drivers/tty/tty_port.c:372 tty_port_close+0x4e/0x150 drivers/tty/tty_port.c:705 tty_release+0x359/0x1670 drivers/tty/tty_io.c:1718 __fput+0x418/0xa50 fs/file_table.c:512 rfcomm_dev_destruct() already copes with a NULL dev->tty_dev. Add the same check to rfcomm_dev_shutdown(), so the tty device is only moved when it was actually registered.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	cad348a17e170451ea8688b532a6ca3e98c63b60 ~ d5c372ad03330f02962d4860df4d355ab25487df	-
Linux	Linux	3.12	-

II. Public POCs for CVE-2026-99008

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99008

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99008 (4)

https://www.cve.org/CVERecord?id=CVE-2026-99008

Same Patch Batch · Linux · 2026-10-23 · 217 CVEs total

CVE-2026-98959	9.8 CRITICAL	btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99078	9.8 CRITICAL	net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99079	9.8 CRITICAL	net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-98988	8.8 HIGH	namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-99083	8.8 HIGH	ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082	8.8 HIGH	KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98870	8.8 HIGH	ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98980	8.8 HIGH	namei: don't reveal overmounted entries in refwalk
CVE-2026-98981	8.8 HIGH	namespace: unhash a dentry before detaching the mounts on it
CVE-2026-99042	8.4 HIGH	io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-98978	8.4 HIGH	namespace: never expire a locked mount
CVE-2026-99064	8.1 HIGH	cipso: adjust cached option offsets when removing CIPSO
CVE-2026-98968	8.1 HIGH	amt: send the relay's General Query directly from the receive path
CVE-2026-98993	7.8 HIGH	namespace: don't inherit MNT_UMOUNT in clone_mnt()
CVE-2026-99053	7.8 HIGH	tipc: hold a reference to nodes found by link name
CVE-2026-99054	7.8 HIGH	tipc: destroy topsrv workqueues before closing connections
CVE-2026-99056	7.8 HIGH	strparser: make sure __strp_recv isn't running before tearing down the parser
CVE-2026-99002	7.8 HIGH	drm/vmwgfx: validate pitch coming from userspace
CVE-2026-98899	7.8 HIGH	netfilter: ipset: mark the rcu locked areas properly
CVE-2026-99014	7.8 HIGH	Bluetooth: hci_sync: Fix command skb lifetime during scan setup

Showing top 20 of 217 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux