In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown syzbot… (CVE-2026-99008)

The Linux kernel Bluetooth RFCOMM driver had a vulnerability where rfcomm_dev_shutdown() could dereference a NULL tty_dev pointer. This happens because rfcomm_dev_add() adds the device to the list before successfully registering the tty device and setting dev->tty_dev. If registration fails, dev->tty_dev remains NULL, but the device can still be looked up and opened. Closing the tty device then causes rfcomm_dev_shutdown() to use dev->tty_dev without checking for NULL, leading to a kernel crash. The patch adds a NULL check in rfcomm_dev_shutdown() to avoid this.

This vulnerability can cause a kernel crash (general protection fault) due to a NULL pointer dereference when closing an RFCOMM tty device. This results in denial of service on affected systems running the vulnerable Linux kernel versions.

A fix has been applied to the Linux kernel source code to add a NULL check in rfcomm_dev_shutdown(). Users should update to a Linux kernel version that includes this fix. Since no specific patched versions are provided, check the vendor or kernel mailing list advisories for the exact fixed version.