In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Serialize dead-device detachment Rebinding an HCI socket… (CVE-2026-99015)

This vulnerability in the Linux kernel's Bluetooth hci_sock component arises from improper synchronization during the detachment of dead devices. Specifically, hci_sock_bind() clears the device pointer and drops the device reference under only the socket lock, while send_monitor_control_replay() reads the device pointer under a different lock (hci_sk_list.lock). This lack of proper serialization can cause a race condition where a NULL pointer dereference or use-after-free occurs when rebinding an HCI socket after its controller is unregistered. The fix involves taking the hci_sk_list.lock for writing when clearing the device pointer and resetting socket state to ensure existing readers finish before detachment and prevent new readers from accessing stale bindings.

Exploitation of this race condition can cause the Linux kernel to crash due to NULL pointer dereference or use-after-free errors in the Bluetooth subsystem. This results in denial of service by kernel panic or instability. There is no indication of privilege escalation or code execution from the provided data.

A fix has been implemented in the Linux kernel to serialize dead-device detachment by acquiring the hci_sk_list.lock for writing when clearing the device pointer and resetting socket state. Users should apply the official kernel update that includes this fix. No additional mitigation steps are indicated.