|
Vulnerabilities
< Back

CVE-2026-23146

Updated on 14 Feb 2026

Severity

5.5 Medium severity

Details

CVSS score
5.5
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work

hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling hci_uart_register_dev(), which calls proto->open() to initialize hu->priv. However, if a TTY write wakeup occurs during this window, hci_uart_tx_wakeup() may schedule write_work before hu->priv is initialized, leading to a NULL pointer dereference in hci_uart_write_work() when proto->dequeue() accesses hu->priv.

The race condition is:

CPU0 CPU1

hci_uart_set_proto() set_bit(HCI_UART_PROTO_INIT) hci_uart_register_dev() tty write wakeup hci_uart_tty_wakeup() hci_uart_tx_wakeup() schedule_work(&hu->write_work) proto->open(hu) // initializes hu->priv hci_uart_write_work() hci_uart_dequeue() proto->dequeue(hu) // accesses hu->priv (NULL!)

Fix this by moving set_bit(HCI_UART_PROTO_INIT) after proto->open() succeeds, ensuring hu->priv is initialized before any work can be scheduled.

Details

Affected product:
AlmaLinux 9.2 ESU , TuxCare 9.6 ESU , Ubuntu 20.04 ELS
Affected packages:
linux @ 5.4.0 (+2 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Debian 11 Planned —
Debian 13 Planned —
Oracle Linux 8 UEK 7 Released
19 kernels
  • 5.15.0-310.184.5.2.el8uek
  • 5.15.0-310.184.5.3.el8uek
  • 5.15.0-311.185.9.el8uek
  • 5.15.0-312.187.5.el8uek
  • 5.15.0-312.187.5.1.el8uek
  • 5.15.0-312.187.5.2.el8uek
  • 5.15.0-312.187.5.3.el8uek
  • 5.15.0-313.189.5.1.el8uek
  • 5.15.0-313.189.5.2.el8uek
  • 5.15.0-313.189.5.3.el8uek
  • 5.15.0-314.193.5.3.el8uek
  • 5.15.0-314.193.5.4.el8uek
  • 5.15.0-314.193.5.5.el8uek
  • 5.15.0-315.196.5.1.el8uek
  • 5.15.0-315.196.5.2.el8uek
  • 5.15.0-316.196.4.1.el8uek
  • 5.15.0-316.196.4.2.el8uek
  • 5.15.0-317.197.5.1.el8uek
  • 5.15.0-317.197.5.2.el8uek
Oracle Linux 9 UEK 7 Released
19 kernels
  • 5.15.0-310.184.5.2.el9uek
  • 5.15.0-310.184.5.3.el9uek
  • 5.15.0-311.185.9.el9uek
  • 5.15.0-312.187.5.el9uek
  • 5.15.0-312.187.5.1.el9uek
  • 5.15.0-312.187.5.2.el9uek
  • 5.15.0-312.187.5.3.el9uek
  • 5.15.0-313.189.5.1.el9uek
  • 5.15.0-313.189.5.2.el9uek
  • 5.15.0-313.189.5.3.el9uek
  • 5.15.0-314.193.5.3.el9uek
  • 5.15.0-314.193.5.4.el9uek
  • 5.15.0-314.193.5.5.el9uek
  • 5.15.0-315.196.5.1.el9uek
  • 5.15.0-315.196.5.2.el9uek
  • 5.15.0-316.196.4.1.el9uek
  • 5.15.0-316.196.4.2.el9uek
  • 5.15.0-317.197.5.1.el9uek
  • 5.15.0-317.197.5.2.el9uek
RHEL 9 Planned —
Ubuntu 22.04 Released
15 kernels
  • 5.15.0-144.157
  • 5.15.0-151.161
  • 5.15.0-152.162
  • 5.15.0-153.163
  • 5.15.0-156.166
  • 5.15.0-157.167
  • 5.15.0-160.170
  • 5.15.0-161.171
  • 5.15.0-163.173
  • 5.15.0-164.174
  • 5.15.0-168.178
  • 5.15.0-170.180
  • 5.15.0-171.181
  • 5.15.0-173.183
  • 5.15.0-174.184
Ubuntu 22.04 AWS Released
15 kernels
  • 5.15.0-1088.95
  • 5.15.0-1089.96
  • 5.15.0-1090.97
  • 5.15.0-1091.98
  • 5.15.0-1092.99
  • 5.15.0-1093.100
  • 5.15.0-1095.102
  • 5.15.0-1096.103
  • 5.15.0-1097.104
  • 5.15.0-1098.105
  • 5.15.0-1099.106
  • 5.15.0-1100.107
  • 5.15.0-1101.108
  • 5.15.0-1103.110
  • 5.15.0-1104.111
Ubuntu 22.04 Azure Released
10 kernels
  • 5.15.0-1094.103
  • 5.15.0-1095.104
  • 5.15.0-1096.105
  • 5.15.0-1097.106
  • 5.15.0-1098.107
  • 5.15.0-1101.110
  • 5.15.0-1102.111
  • 5.15.0-1099.108
  • 5.15.0-1103.112
  • 5.15.0-1109.118
Ubuntu 24.04 Released
6 kernels
  • 6.8.0-100.100
  • 6.8.0-101.101
  • 6.8.0-106.106
  • 6.8.0-107.107
  • 6.8.0-110.110
  • 6.8.0-111.111
Ubuntu 24.04 AWS Planned —