Skip to main content
CVE-2026-99008VulnerabilityPublished Updated

rfcomm_dev_shutdown · Bluetooth: RFCOMM: Fix NULL tty_dev dereference

Affects MicrosoftSource GCVE Database

0
Compare
Authoritative record:CVE-2026-99008· Medium

Not known to be exploited · fixed in d5c372ad03330f02962d4860df4d355ab25487df : update Microsoft when convenient.

Data as of 7 Nov 2026, 13:34 UTC

Severity
Medium

Rated by Threat Radar · CVSS not yet scored by NVD

Thin evidence

One scorer or none
Patch
Available – fixed in d5c372ad03330f02962d4860df4d355ab25487df, d0aef0b0374678153244f162df507106d728af39, b2b915042be073637d9f93dc51ef15fc0685ae8a +5

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 23 Oct 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 7 Nov 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
LinuxLinuxAffected
  • ≥ cad348a17e170451ea8688b532a6ca3e98c63b60, < d5c372ad03330f02962d4860df4d355ab25487df
Fixed in
  • d5c372ad03330f02962d4860df4d355ab25487df
LinuxLinuxAffected
  • ≥ cad348a17e170451ea8688b532a6ca3e98c63b60, < d0aef0b0374678153244f162df507106d728af39
Fixed in
  • d0aef0b0374678153244f162df507106d728af39
LinuxLinuxAffected
  • ≥ cad348a17e170451ea8688b532a6ca3e98c63b60, < b2b915042be073637d9f93dc51ef15fc0685ae8a
Fixed in
  • b2b915042be073637d9f93dc51ef15fc0685ae8a
LinuxLinuxAffected
  • ≥ cad348a17e170451ea8688b532a6ca3e98c63b60, < a43452d8c1015ac2f0e43ff946be5425427b02cc
Fixed in
  • a43452d8c1015ac2f0e43ff946be5425427b02cc
LinuxLinuxAffected
  • ≥ cad348a17e170451ea8688b532a6ca3e98c63b60, < a661f401f83b8462f2d424e0a1a72b7681e92ea2
Fixed in
  • a661f401f83b8462f2d424e0a1a72b7681e92ea2
LinuxLinuxAffected
  • ≥ cad348a17e170451ea8688b532a6ca3e98c63b60, < 08e90633377f1b2567ab5ad6810b74c552246a07
Fixed in
  • 08e90633377f1b2567ab5ad6810b74c552246a07

Description

A vulnerability identified as CVE-2026-99008 affects Microsoft Bluetooth RFCOMM implementations, specifically involving a NULL pointer dereference in the rfcomm_dev_shutdown function. This flaw could cause improper handling of device shutdown sequences.

References

Community reviews

Loading reviews…