CVE-2026-97975

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()

A NULL pointer dereference in klist_put() occurs when a child device (such

as a BNEP network device in bnep_session) is concurrently being

unregistered while hci_conn_del_sysfs() reparents child devices.

This is caused by a race condition between hci_conn_del_sysfs() and

concurrent child device unregistration (e.g. bnep_session calling

unregister_netdev()). During device unregistration, device_del() snapshots

a non-NULL parent pointer. Concurrently, hci_conn_del_sysfs() finds the

child device using device_find_any_child() and calls device_move() to

reparent it to NULL, which removes the node from its parent's klist and

clears knode_parent. Subsequently, device_del() calls

klist_del(&dev->p->knode_parent) using the stale parent snapshot, causing

klist_put() to dereference knode_klist(n)->put on an already removed node,

resulting in a NULL pointer dere

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References