CVE-2026-97977

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: Fix UAF of btusb data by rx work

btusb close() and btusb flush() cancel data->rx work with the asynchronous cancel delayed work(), so if btusb rx work() is already running on another CPU it keeps running after the cancel returns.

btusb disconnect() calls hci unregister dev(), which invokes btusb close(), and then frees the btusb data. A still running btusb rx work() then dereferences the freed data:

while ((skb = skb dequeue(&data->acl q)))
	data->recv acl(data->hdev, skb);

Use cancel delayed work sync() instead. In btusb close() the cancel also has to happen after btusb stop traffic(), otherwise an URB completion racing with the cancel can requeue the work right after it has been waited for.