CVE-2026-99008

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99008", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.385Z", "datePublished": "2026-10-23T12:20:33.355Z", "dateUpdated": "2026-10-30T12:40:53.373Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:40:53.373Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown\n\nsyzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an\nRFCOMM tty is closed.\n\nrfcomm_dev_add() puts the new device on rfcomm_dev_list first and only\nthen registers the tty device and saves it in dev->tty_dev. If that\nregistration fails, dev->tty_dev is never set at all. The device can be\nlooked up in the meantime, so an open() of /dev/rfcommN gets through\nrfcomm_tty_install() and attaches to it. When that tty is closed again,\nrfcomm_dev_shutdown() uses dev->tty_dev without checking it:\n\n Oops: general protection fault, probably for non-canonical address\n KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]\n RIP: 0010:rfcomm_dev_shutdown+0x48/0xb0 net/bluetooth/rfcomm/tty.c:131\n Call Trace:\n tty_port_shutdown+0x1bf/0x220 drivers/tty/tty_port.c:372\n tty_port_close+0x4e/0x150 drivers/tty/tty_port.c:705\n tty_release+0x359/0x1670 drivers/tty/tty_io.c:1718\n __fput+0x418/0xa50 fs/file_table.c:512\n\nrfcomm_dev_destruct() already copes with a NULL dev->tty_dev. Add the\nsame check to rfcomm_dev_shutdown(), so the tty device is only moved\nwhen it was actually registered."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/rfcomm/tty.c"], "versions": [{"version": "cad348a17e170451ea8688b532a6ca3e98c63b60", "lessThan": "b2b915042be073637d9f93dc51ef15fc0685ae8a", "status": "affected", "versionType": "git"}, {"version": "cad348a17e170451ea8688b532a6ca3e98c63b60", "lessThan": "a43452d8c1015ac2f0e43ff946be5425427b02cc", "status": "affected", "versionType": "git"}, {"version": "cad348a17e170451ea8688b532a6ca3e98c63b60", "lessThan": "3f6394f6c6d1b6817065d3b402f55d437063a704", "status": "affected", "versionType": "git"}, {"version": "cad348a17e170451ea8688b532a6ca3e98c63b60", "lessThan": "d5c372ad03330f02962d4860df4d355ab25487df", "status": "affected", "versionType": "git"}, {"version": "cad348a17e170451ea8688b532a6ca3e98c63b60", "lessThan": "3fd5164bdb04635caa7942ddb554b0ec699a9433", "status": "affected", "versionType": "git"}, {"version": "cad348a17e170451ea8688b532a6ca3e98c63b60", "lessThan": "a661f401f83b8462f2d424e0a1a72b7681e92ea2", "status": "affected", "versionType": "git"}, {"version": "cad348a17e170451ea8688b532a6ca3e98c63b60", "lessThan": "d0aef0b0374678153244f162df507106d728af39", "status": "affected", "versionType": "git"}, {"version": "cad348a17e170451ea8688b532a6ca3e98c63b60", "lessThan": "08e90633377f1b2567ab5ad6810b74c552246a07", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/rfcomm/tty.c"], "versions": [{"version": "3.12", "status": "affected"}, {"version": "0", "lessThan": "3.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b2b915042be073637d9f93dc51ef15fc0685ae8a"}, {"url": "https://git.kernel.org/stable/c/a43452d8c1015ac2f0e43ff946be5425427b02cc"}, {"url": "https://git.kernel.org/stable/c/3f6394f6c6d1b6817065d3b402f55d437063a704"}, {"url": "https://git.kernel.org/stable/c/d5c372ad03330f02962d4860df4d355ab25487df"}, {"url": "https://git.kernel.org/stable/c/3fd5164bdb04635caa7942ddb554b0ec699a9433"}, {"url": "https://git.kernel.org/stable/c/a661f401f83b8462f2d424e0a1a72b7681e92ea2"}, {"url": "https://git.kernel.org/stable/c/d0aef0b0374678153244f162df507106d728af39"}, {"url": "https://git.kernel.org/stable/c/08e90633377f1b2567ab5ad6810b74c552246a07"}], "title": "Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/rfcomm/tty.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b2b915042be073637d9f93dc51ef15fc0685ae8a", "status": "affected", "version": "cad348a17e170451ea8688b532a6ca3e98c63b60", "versionType": "git"}, {"lessThan": "a43452d8c1015ac2f0e43ff946be5425427b02cc", "status": "affected", "version": "cad348a17e170451ea8688b532a6ca3e98c63b60", "versionType": "git"}, {"lessThan": "3f6394f6c6d1b6817065d3b402f55d437063a704", "status": "affected", "version": "cad348a17e170451ea8688b532a6ca3e98c63b60", "versionType": "git"}, {"lessThan": "d5c372ad03330f02962d4860df4d355ab25487df", "status": "affected", "version": "cad348a17e170451ea8688b532a6ca3e98c63b60", "versionType": "git"}, {"lessThan": "3fd5164bdb04635caa7942ddb554b0ec699a9433", "status": "affected", "version": "cad348a17e170451ea8688b532a6ca3e98c63b60", "versionType": "git"}, {"lessThan": "a661f401f83b8462f2d424e0a1a72b7681e92ea2", "status": "affected", "version": "cad348a17e170451ea8688b532a6ca3e98c63b60", "versionType": "git"}, {"lessThan": "d0aef0b0374678153244f162df507106d728af39", "status": "affected", "version": "cad348a17e170451ea8688b532a6ca3e98c63b60", "versionType": "git"}, {"lessThan": "08e90633377f1b2567ab5ad6810b74c552246a07", "status": "affected", "version": "cad348a17e170451ea8688b532a6ca3e98c63b60", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/rfcomm/tty.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.12"}, {"lessThan": "3.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown\n\nsyzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an\nRFCOMM tty is closed.\n\nrfcomm_dev_add() puts the new device on rfcomm_dev_list first and only\nthen registers the tty device and saves it in dev->tty_dev. If that\nregistration fails, dev->tty_dev is never set at all. The device can be\nlooked up in the meantime, so an open() of /dev/rfcommN gets through\nrfcomm_tty_install() and attaches to it. When that tty is closed again,\nrfcomm_dev_shutdown() uses dev->tty_dev without checking it:\n\n Oops: general protection fault, probably for non-canonical address\n KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]\n RIP: 0010:rfcomm_dev_shutdown+0x48/0xb0 net/bluetooth/rfcomm/tty.c:131\n Call Trace:\n tty_port_shutdown+0x1bf/0x220 drivers/tty/tty_port.c:372\n tty_port_close+0x4e/0x150 drivers/tty/tty_port.c:705\n tty_release+0x359/0x1670 drivers/tty/tty_io.c:1718\n __fput+0x418/0xa50 fs/file_table.c:512\n\nrfcomm_dev_destruct() already copes with a NULL dev->tty_dev. Add the\nsame check to rfcomm_dev_shutdown(), so the tty device is only moved\nwhen it was actually registered."}], "id": "CVE-2026-99008", "lastModified": "2026-10-30T13:21:35.450", "metrics": {}, "published": "2026-10-23T13:17:23.290", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/08e90633377f1b2567ab5ad6810b74c552246a07"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3f6394f6c6d1b6817065d3b402f55d437063a704"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3fd5164bdb04635caa7942ddb554b0ec699a9433"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a43452d8c1015ac2f0e43ff946be5425427b02cc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a661f401f83b8462f2d424e0a1a72b7681e92ea2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b2b915042be073637d9f93dc51ef15fc0685ae8a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d0aef0b0374678153244f162df507106d728af39"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d5c372ad03330f02962d4860df4d355ab25487df"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown", "id": "2559807", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559807"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown\nsyzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an\nRFCOMM tty is closed.\nrfcomm_dev_add() puts the new device on rfcomm_dev_list first and only\nthen registers the tty device and saves it in dev->tty_dev. If that\nregistration fails, dev->tty_dev is never set at all. The device can be\nlooked up in the meantime, so an open() of /dev/rfcommN gets through\nrfcomm_tty_install() and attaches to it. When that tty is closed again,\nrfcomm_dev_shutdown() uses dev->tty_dev without checking it:\nOops: general protection fault, probably for non-canonical address\nKASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]\nRIP: 0010:rfcomm_dev_shutdown+0x48/0xb0 net/bluetooth/rfcomm/tty.c:131\nCall Trace:\ntty_port_shutdown+0x1bf/0x220 drivers/tty/tty_port.c:372\ntty_port_close+0x4e/0x150 drivers/tty/tty_port.c:705\ntty_release+0x359/0x1670 drivers/tty/tty_io.c:1718\n__fput+0x418/0xa50 fs/file_table.c:512\nrfcomm_dev_destruct() already copes with a NULL dev->tty_dev. Add the\nsame check to rfcomm_dev_shutdown(), so the tty device is only moved\nwhen it was actually registered.", "A flaw was found in the Linux kernel's Bluetooth subsystem. When an RFCOMM (Radio Frequency Communication) terminal device fails to register properly during initialization, closing the device triggers a null pointer dereference in the shutdown handler. A local attacker could exploit this vulnerability by opening and closing the affected device, leading to a system crash and a denial of service (DoS)."], "name": "CVE-2026-99008", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99008\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99008\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99008.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cad348a17e170451ea8688b532a6ca3e98c63b60,d5c372ad03330f02962d4860df4d355ab25487df)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cad348a17e170451ea8688b532a6ca3e98c63b60,3fd5164bdb04635caa7942ddb554b0ec699a9433)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cad348a17e170451ea8688b532a6ca3e98c63b60,a661f401f83b8462f2d424e0a1a72b7681e92ea2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cad348a17e170451ea8688b532a6ca3e98c63b60,d0aef0b0374678153244f162df507106d728af39)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cad348a17e170451ea8688b532a6ca3e98c63b60,08e90633377f1b2567ab5ad6810b74c552246a07)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cad348a17e170451ea8688b532a6ca3e98c63b60,d5c372ad03330f02962d4860df4d355ab25487df)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cad348a17e170451ea8688b532a6ca3e98c63b60,3fd5164bdb04635caa7942ddb554b0ec699a9433)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cad348a17e170451ea8688b532a6ca3e98c63b60,a661f401f83b8462f2d424e0a1a72b7681e92ea2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cad348a17e170451ea8688b532a6ca3e98c63b60,d0aef0b0374678153244f162df507106d728af39)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cad348a17e170451ea8688b532a6ca3e98c63b60,08e90633377f1b2567ab5ad6810b74c552246a07)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T15:30:14.847585+00:00", "updated": "2026-10-29T19:15:08.635412+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}