CVE-2026-99008

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Fix NULL tty dev dereference in rfcomm dev shutdown

syzbot hit a NULL pointer dereference in rfcomm dev shutdown() when an RFCOMM tty is closed.

rfcomm dev add() puts the new device on rfcomm dev list first and only then registers the tty device and saves it in dev->tty dev. If that registration fails, dev->tty dev is never set at all. The device can be looked up in the meantime, so an open() of /dev/rfcommN gets through rfcomm tty install() and attaches to it. When that tty is closed again, rfcomm dev shutdown() uses dev->tty dev without checking it:

Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] RIP: 0010:rfcomm dev shutdown+0x48/0xb0 net/bluetooth/rfcomm/tty.c:131 Call Trace: tty port shutdown+0x1bf/0x220 drivers/tty/tty port.c:372 tty port close+0x4e/0x150 drivers/tty/tty port.c:705 tty release+0x359/0x1670 drivers/tty/tty io.c:1718 fput+0x418/0xa50 fs/file table.c:512

rfcomm dev destruct() already copes with a NULL dev->tty dev. Add the same check to rfcomm dev shutdown(), so the tty device is only moved when it was actually registered.