Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-99015— Bluetooth: hci_sock: Serialize dead-device detachment

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复：蓝牙：hci_sock：对设备断开连接操作进行序列化在控制器被注销后重新绑定 HCI 套接字时，可能与监控控制重放（monitor control replay）机制发生竞态条件，从而导致内核崩溃。具体而言，仅在持有套接字锁的情况下清除并释放设备引用；而仅以读模式持有。重放机制可能先观察到非空的指针，随后操作将其清零并释放最后一个引用，而此时尚未读取。这可能导致两种后果：若指针被重新加载，则引发空指针解引用；若旧指针被保留，则导致释放后使用（use-

AI Predicted 8.8 Difficulty: Moderate EPSS 0.17% · P6 Updated Oct 23, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 26

Vendor	Product	Version Range	Status
Linux	Linux	`e04480920d1eec9c061841399aa6f35b6f987d8b< 37cef0c8fb537f40600910d2c2e5f2d5509305f3`	affected
		`e04480920d1eec9c061841399aa6f35b6f987d8b< 76f2e2665697340ac719e7ff1bf148dd014e55c1`	affected
		`e04480920d1eec9c061841399aa6f35b6f987d8b< c3d2799877906d0c8392d96e14216cd82b020330`	affected
		`e04480920d1eec9c061841399aa6f35b6f987d8b< e660a22402944f2615a16fde7129a3c497537329`	affected
		`e04480920d1eec9c061841399aa6f35b6f987d8b< 381a0925c556a8d91a80a9b9e3e86651d60ffee3`	affected
		`d6ef8bb00aa65eceb413fc165a55086459863e38`	affected
		`0e77f979a97d3d517fad0b51249ba6fb8ae2d365`	affected
		`0782c8c7f80c9dd457acdfe16fd0f339f0e73093`	affected
… +18 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Bluetooth: hci_sock: Serialize dead-device detachment

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hci_sock_bind() clears hci_pi(sk)->hdev and drops the device reference under only the socket lock, whereas send_monitor_control_replay() holds hci_sk_list.lock for reading. Replay can observe a non-NULL hdev, then bind can clear it and drop the last reference before create_monitor_ctrl_open() reads hdev->id. This can cause a NULL pointer dereference if the pointer is reloaded, or a use-after-free if the old pointer is retained. The kernel reported: KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] RIP: 0010:create_monitor_ctrl_open+0x579/0x800 Call Trace: hci_sock_bind+0xd96/0x1190 __sys_bind+0x166/0x200 __x64_sys_bind+0x6d/0xb0 do_syscall_64+0xdd/0x4a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f The same missing serialization lets hci_send_to_sock() select a socket for the old device and queue its frame after bind has detached the socket or installed a new binding. Take hci_sk_list.lock for writing when clearing the device pointer and resetting the socket state. This waits for existing replay and delivery readers to finish before detachment and prevents later readers from using the old binding. Keep hci_dev_put() outside the critical section because the final device release can sleep.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	e04480920d1eec9c061841399aa6f35b6f987d8b ~ 37cef0c8fb537f40600910d2c2e5f2d5509305f3	-
Linux	Linux	5.14	-

II. Public POCs for CVE-2026-99015

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99015

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99015 (5)

https://www.cve.org/CVERecord?id=CVE-2026-99015

Same Patch Batch · Linux · 2026-10-23 · 217 CVEs total

CVE-2026-98959	9.8 CRITICAL	btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99078	9.8 CRITICAL	net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99079	9.8 CRITICAL	net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-98988	8.8 HIGH	namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-99083	8.8 HIGH	ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082	8.8 HIGH	KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98870	8.8 HIGH	ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98980	8.8 HIGH	namei: don't reveal overmounted entries in refwalk
CVE-2026-98981	8.8 HIGH	namespace: unhash a dentry before detaching the mounts on it
CVE-2026-99042	8.4 HIGH	io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-98978	8.4 HIGH	namespace: never expire a locked mount
CVE-2026-99064	8.1 HIGH	cipso: adjust cached option offsets when removing CIPSO
CVE-2026-98968	8.1 HIGH	amt: send the relay's General Query directly from the receive path
CVE-2026-98993	7.8 HIGH	namespace: don't inherit MNT_UMOUNT in clone_mnt()
CVE-2026-99053	7.8 HIGH	tipc: hold a reference to nodes found by link name
CVE-2026-99054	7.8 HIGH	tipc: destroy topsrv workqueues before closing connections
CVE-2026-99056	7.8 HIGH	strparser: make sure __strp_recv isn't running before tearing down the parser
CVE-2026-99002	7.8 HIGH	drm/vmwgfx: validate pitch coming from userspace
CVE-2026-98899	7.8 HIGH	netfilter: ipset: mark the rcu locked areas properly
CVE-2026-99014	7.8 HIGH	Bluetooth: hci_sync: Fix command skb lifetime during scan setup

Showing top 20 of 217 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux