CVE-2026-97977 Bluetooth: btusb: Fix UAF of btusb_data by rx_work
A use-after-free in the Linux kernel Bluetooth USB driver allows attackers with physical or local access to execute arbitrary code or crash the system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97977?
CVE-2026-97977 is an use after free vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btusb: Fix UAF of btusb_data by rx_work
btusb_close() and btusb_flush() cancel data->rx_work with the asynchronous cancel_delayed_work(), so if btusb_rx_work() is already running on another CPU it keeps running after the cancel returns.
btusb_disconnect() calls hci_unregister_dev(), which invokes btusb_close(), and then frees the btusb_data. A still running btusb_rx_work() then dereferences the freed data:
while ((skb = skb_dequeue(&data->acl_q))) data->recv_acl(data->hdev, skb);
Use cancel_delayed_work_sync() instead. In btusb_close() the cancel also has to happen after btusb_stop_traffic(), otherwise an URB completion racing with the cancel can requeue the work right after it has been waited for.
Which versions are affected by CVE-2026-97977?
How do I fix CVE-2026-97977?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-97977 being exploited?
There is no known exploitation of CVE-2026-97977 in the wild and no public exploit code.
Sources
Also known as AZL-104853, BELL-CVE-2026-97977, DEBIAN-CVE-2026-97977, GHSA-mvpx-42x3-8643, UBUNTU-CVE-2026-97977.