Not yet scoredPublished Sep 25, 2026

CVE-2026-97977Bluetooth: btusb: Fix UAF of btusb_data by rx_work

Updated under an hour ago (Oct 27, 2026, 3:23 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix UAF of btusb_data by rx_work btusb_close() and btusb_flush() cancel data->rx_work with the asynchronous cancel_delayed_work(), so if btusb_rx_work() is already running on another CPU it keeps running after the cancel returns. btusb_disconnect() calls hci_unregister_dev(), which invokes btusb_close(), and then frees the btusb_data. A still running btusb_rx_work() then dereferences the freed data: while ((skb = skb_dequeue(&data->acl_q))) data->recv_acl(data->hdev, skb); Use cancel_delayed_work_sync() instead. In btusb_close() the cancel also has to happen after btusb_stop_traffic(), otherwise an URB completion racing with the cancel can requeue the work right after it has been waited for.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 800fe5ec302e1ebbf5e3f891f886deecd49c7132 before fc654a72a8d979db15e2773a481e931abaf5a9e8; from 800fe5ec302e1ebbf5e3f891f886deecd49c7132 before 5242050195a711e9cd6a9935f689ab6656b94a91; 800fe5ec302e1ebbf5e3f891f886deecd49c7132 builds before 472d005622525b7be155cac99dde2252b0163bd1; 800fe5ec302e1ebbf5e3f891f886deecd49c7132 builds before 93b59937bda3fffc6386c79f5544a39bc680c8e8; from 800fe5ec302e1ebbf5e3f891f886deecd49c7132 before fa391adb9c755515a89993634745e9079e5ef37c; 800fe5ec302e1ebbf5e3f891f886deecd49c7132 builds before 1c12c3117639e78940959d956519c758c57d0849	CNA record

References

References

https://git.kernel.org/stable/c/fc654a72a8d979db15e2773a481e931abaf5a9e8
https://git.kernel.org/stable/c/5242050195a711e9cd6a9935f689ab6656b94a91
https://git.kernel.org/stable/c/472d005622525b7be155cac99dde2252b0163bd1
https://git.kernel.org/stable/c/93b59937bda3fffc6386c79f5544a39bc680c8e8
https://git.kernel.org/stable/c/fa391adb9c755515a89993634745e9079e5ef37c
https://git.kernel.org/stable/c/1c12c3117639e78940959d956519c758c57d0849

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.