CVE-2026-99008Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
- —Not scoredno CVSS score yet
- 0.18%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown syzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an RFCOMM tty is closed. rfcomm_dev_add() puts the new device on rfcomm_dev_list first and only then registers the tty device and saves it in dev->tty_dev. If that registration fails, dev->tty_dev is never set at all. The device can be looked up in the meantime, so an open() of /dev/rfcommN gets through rfcomm_tty_install() and attaches to it. When that tty is closed again, rfcomm_dev_shutdown() uses dev->tty_dev without checking it: Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] RIP: 0010:rfcomm_dev_shutdown+0x48/0xb0 net/bluetooth/rfcomm/tty.c:131 Call Trace: tty_port_shutdown+0x1bf/0x220 drivers/tty/tty_port.c:372 tty_port_close+0x4e/0x150 drivers/tty/tty_port.c:705 tty_release+0x359/0x1670 drivers/tty/tty_io.c:1718 __fput+0x418/0xa50 fs/file_table.c:512 rfcomm_dev_destruct() already copes with a NULL dev->tty_dev. Add the same check to rfcomm_dev_shutdown(), so the tty device is only moved when it was actually registered.
Timeline
ID reserved
By Linux
- 28 days later
· 28 days later
Published
- 7 days later
· 7 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.18% · top 93% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected cad348a17e170451ea8688b532a6ca3e98c63b60 – < b2b915042be073637d9f93dc51ef15fc0685ae8a
- affected cad348a17e170451ea8688b532a6ca3e98c63b60 – < a43452d8c1015ac2f0e43ff946be5425427b02cc
- affected cad348a17e170451ea8688b532a6ca3e98c63b60 – < 3f6394f6c6d1b6817065d3b402f55d437063a704
- affected cad348a17e170451ea8688b532a6ca3e98c63b60 – < d5c372ad03330f02962d4860df4d355ab25487df
- affected cad348a17e170451ea8688b532a6ca3e98c63b60 – < 3fd5164bdb04635caa7942ddb554b0ec699a9433
- affected cad348a17e170451ea8688b532a6ca3e98c63b60 – < a661f401f83b8462f2d424e0a1a72b7681e92ea2
- affected cad348a17e170451ea8688b532a6ca3e98c63b60 – < d0aef0b0374678153244f162df507106d728af39
- affected cad348a17e170451ea8688b532a6ca3e98c63b60 – < 08e90633377f1b2567ab5ad6810b74c552246a07
- affected 3.12
- unaffected < 3.12
- unaffected 5.10.273 – ≤ 5.10.*
- unaffected 5.15.224 – ≤ 5.15.*
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.113 – ≤ 6.12.*
- unaffected 6.18.57 – ≤ 6.18.*
- unaffected 7.2.11 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/b2b915042be073637d9f93dc51ef15fc0685ae8a (opens in a new tab)
- https://git.kernel.org/stable/c/a43452d8c1015ac2f0e43ff946be5425427b02cc (opens in a new tab)
- https://git.kernel.org/stable/c/3f6394f6c6d1b6817065d3b402f55d437063a704 (opens in a new tab)
- https://git.kernel.org/stable/c/d5c372ad03330f02962d4860df4d355ab25487df (opens in a new tab)
- https://git.kernel.org/stable/c/3fd5164bdb04635caa7942ddb554b0ec699a9433 (opens in a new tab)
- https://git.kernel.org/stable/c/a661f401f83b8462f2d424e0a1a72b7681e92ea2 (opens in a new tab)
- https://git.kernel.org/stable/c/d0aef0b0374678153244f162df507106d728af39 (opens in a new tab)
- https://git.kernel.org/stable/c/08e90633377f1b2567ab5ad6810b74c552246a07 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-108802 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-99008)Record last updated .