VulnerabilityPublished 25 Sep 2026Updated 30 Oct 2026

CVE-2026-97908: Linux kernel · Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev

Source GCVE Database

Compare

Authoritative record:CVE-2026-97908· Medium

Not known to be exploited · fixed in f5e4f81f4e075cd5ec062f81b576b88cdee998d1 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 17:19 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in f5e4f81f4e075cd5ec062f81b576b88cdee998d1, f5a427b16e45210dee656b0860728f3d496dee85, e2a0d9401368ec29bd0cdbfe9545d2a800429875 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-rm82-grpq-rh3c

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 5052de8deff5619a9b7071f00084fd0264b58e17, < f5e4f81f4e075cd5ec062f81b576b88cdee998d1	Fixed in f5e4f81f4e075cd5ec062f81b576b88cdee998d1
LinuxLinux	Affected ≥ 5052de8deff5619a9b7071f00084fd0264b58e17, < f5a427b16e45210dee656b0860728f3d496dee85	Fixed in f5a427b16e45210dee656b0860728f3d496dee85
LinuxLinux	Affected ≥ 5052de8deff5619a9b7071f00084fd0264b58e17, < e2a0d9401368ec29bd0cdbfe9545d2a800429875	Fixed in e2a0d9401368ec29bd0cdbfe9545d2a800429875
LinuxLinux	Affected ≥ 5052de8deff5619a9b7071f00084fd0264b58e17, < b9b34cc149f8344d1cffbf318eb1c8cb414f74ac	Fixed in b9b34cc149f8344d1cffbf318eb1c8cb414f74ac
LinuxLinux	Affected ≥ 5052de8deff5619a9b7071f00084fd0264b58e17, < aaa7f676418e1eb2c4ef0d4e4b07812b25e7b404	Fixed in aaa7f676418e1eb2c4ef0d4e4b07812b25e7b404
LinuxLinux	Affected ≥ 5052de8deff5619a9b7071f00084fd0264b58e17, < 962dcc1d8a52e64428cae07806e7f6b8d3ec6ac0	Fixed in 962dcc1d8a52e64428cae07806e7f6b8d3ec6ac0

AI-suggested

A fix has been implemented in the Linux kernel to reorder the teardown sequence, destroying RPMsg endpoints before freeing the hci_dev device. Users should update to a Linux kernel version that includes this fix. No additional mitigation is required beyond applying the official patch.

Description

A use-after-free vulnerability in the Linux kernel Bluetooth driver btqcomsmd was fixed by changing the order of resource teardown. The flaw involved freeing the hci_dev device before destroying RPMsg endpoints, which could lead to callbacks accessing freed memory.

References

Community reviews

Loading reviews…