CVE-2026-23146

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Bluetooth implementation of the Linux kernel related to a null pointer dereference within the hci uart write work() function. The issue arises from a race condition where the HCI UART PROTO INIT flag is set before the hu->priv structure is initialized. A TTY write wakeup can then schedule work to be performed before initialization is complete, leading to a null pointer dereference when proto->dequeue() attempts to access the uninitialized hu->priv. The vulnerable function is hci uart write work(). The hci uart set proto() function sets the HCI UART PROTO INIT flag, and hci uart register dev() calls proto->open() to initialize hu->priv. The hci uart tx wakeup() function schedules work before hu->priv is initialized.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.