🛡️ CVE-2026-23146 — kernel

Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work

hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling

hci_uart_register_dev(), which calls proto->open() to initialize

hu->priv. However, if a TTY write wakeup occurs during this window,

hci_uart_tx_wakeup() may schedule write_work before hu->priv is

initialized, leading to a NULL pointer dereference in

hci_uart_write_work() when proto->dequeue() accesses hu->priv.

The race condition is:

CPU0 CPU1

---- ----

hci_uart_set_proto()

set_bit(HCI_UART_PROTO_INIT)

hci_uart_register_dev()

tty write wakeup

hci_uart_tty_wakeup()

hci_uart_tx_wakeup()

schedule_work(&hu->write_work)

proto->open(hu)

// initializes hu->priv

hci_uart_write_work()

hci_uart_dequeue()

proto->dequeue(hu)

// accesses hu->priv (NULL!)

Fix this by moving set_bit(HCI_UART_PROTO_INIT) after proto->open()

succeeds, ensuring hu->priv is initialized before any work can be

scheduled.