CVE-2026-23146
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling hci_uart_register_dev(), which calls proto->open() to initialize hu->priv. However, if a TTY write wakeup occurs during this window, hci_uart_tx_wakeup() may schedule write_work before hu->priv is initialized, leading to a NULL pointer dereference in hci_uart_write_work() when proto->dequeue() accesses hu->priv.
The race condition is:
Fix this by moving set_bit(HCI_UART_PROTO_INIT) after proto->open() succeeds, ensuring hu->priv is initialized before any work can be scheduled.
Detalles técnicos trazas, registros y código del informe original
CPU0 CPU1
---- ----
hci_uart_set_proto()
set_bit(HCI_UART_PROTO_INIT)
hci_uart_register_dev()
tty write wakeup
hci_uart_tty_wakeup()
hci_uart_tx_wakeup()
schedule_work(&hu->write_work)
proto->open(hu)
// initializes hu->priv
hci_uart_write_work()
hci_uart_dequeue()
proto->dequeue(hu)
// accesses hu->priv (NULL!)CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.13%
- Percentil entre todas las CVEs puntuadas: 2
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-476
Referencias
- https://git.kernel.org/stable/c/03e8c90c62233382042b7bd0fa8b8900552fdb62
- https://git.kernel.org/stable/c/0c3cd7a0b862c37acbee6d9502107146cc944398
- https://git.kernel.org/stable/c/186d147cf7689ba1f9b3ddb753ab634a84940cc9
- https://git.kernel.org/stable/c/53e54cb31e667fca05b1808b990eac0807d1dab0
- https://git.kernel.org/stable/c/937a573423ce5a96fdb1fd425dc6b8d8d4ab5779
- https://git.kernel.org/stable/c/b0a900939e7e4866d9b90e9112514b72c451e873
- https://git.kernel.org/stable/c/ccc683f597ceb28deb966427ae948e5ac739a909
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-23146",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-23146",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-06-10T20:41:53.104941Z"
}
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "a40f94f7caa8d3421b64f63ac31bc0f24c890f39",
"lessThan": "b0a900939e7e4866d9b90e9112514b72c451e873",
"versionType": "git"
},
{
"status": "affected",
"version": "9e5a0f5777162e503400c70c6ed25fbbe2d38799",
"lessThan": "ccc683f597ceb28deb966427ae948e5ac739a909",
"versionType": "git"
},
{
"status": "affected",
"version": "80f14e9de6a43a0bd8194cad1003a3e6dcbc3984",
"lessThan": "937a573423ce5a96fdb1fd425dc6b8d8d4ab5779",
"versionType": "git"
},
{
"status": "affected",
"version": "02e1bcdfdf769974e7e9fa285e295cd9852e2a38",
"lessThan": "186d147cf7689ba1f9b3ddb753ab634a84940cc9",
"versionType": "git"
},
{
"status": "affected",
"version": "281782d2c6730241e300d630bb9f200d831ede71",
"lessThan": "53e54cb31e667fca05b1808b990eac0807d1dab0",
"versionType": "git"
},
{
"status": "affected",
"version": "5df5dafc171b90d0b8d51547a82657cd5a1986c7",
"lessThan": "03e8c90c62233382042b7bd0fa8b8900552fdb62",
"versionType": "git"
},
{
"status": "affected",
"version": "5df5dafc171b90d0b8d51547a82657cd5a1986c7",
"lessThan": "0c3cd7a0b862c37acbee6d9502107146cc944398",
"versionType": "git"
},
{
"status": "affected",
"version": "1dcf08fcff5ca529de6dc0395091f28854f4e54a",
"versionType": "git"
},
{
"status": "affected",
"version": "8e5aff600539e5faea294d9612cca50220e602b8",
"versionType": "git"
},
{
"status": "affected",
"version": "db7509fa110dd9b11134b75894677f30353b2c51",
"versionType": "git"
},
{
"status": "affected",
"version": "5.10.237",
"lessThan": "5.10.249",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.181",
"lessThan": "5.15.199",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.135",
"lessThan": "6.1.162",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.88",
"lessThan": "6.6.123",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.24",
"lessThan": "6.12.69",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.4.293",
"lessThan": "5.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.13.12",
"lessThan": "6.14",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.14.3",
"lessThan": "6.15",
"versionType": "semver"
}
],
"programFiles": [
"drivers/bluetooth/hci_ldisc.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.249",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.199",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.162",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.123",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.69",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.9",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/bluetooth/hci_ldisc.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-02-14T16:15:54.703",
"references": [
{
"url": "https://git.kernel.org/stable/c/03e8c90c62233382042b7bd0fa8b8900552fdb62",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0c3cd7a0b862c37acbee6d9502107146cc944398",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/186d147cf7689ba1f9b3ddb753ab634a84940cc9",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/53e54cb31e667fca05b1808b990eac0807d1dab0",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/937a573423ce5a96fdb1fd425dc6b8d8d4ab5779",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b0a900939e7e4866d9b90e9112514b72c451e873",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ccc683f597ceb28deb966427ae948e5ac739a909",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work\n\nhci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling\nhci_uart_register_dev(), which calls proto->open() to initialize\nhu->priv. However, if a TTY write wakeup occurs during this window,\nhci_uart_tx_wakeup() may schedule write_work before hu->priv is\ninitialized, leading to a NULL pointer dereference in\nhci_uart_write_work() when proto->dequeue() accesses hu->priv.\n\nThe race condition is:\n\n CPU0 CPU1\n ---- ----\n hci_uart_set_proto()\n set_bit(HCI_UART_PROTO_INIT)\n hci_uart_register_dev()\n tty write wakeup\n hci_uart_tty_wakeup()\n hci_uart_tx_wakeup()\n schedule_work(&hu->write_work)\n proto->open(hu)\n // initializes hu->priv\n hci_uart_write_work()\n hci_uart_dequeue()\n proto->dequeue(hu)\n // accesses hu->priv (NULL!)\n\nFix this by moving set_bit(HCI_UART_PROTO_INIT) after proto->open()\nsucceeds, ensuring hu->priv is initialized before any work can be\nscheduled."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: hci_uart: corrección de desreferencia de puntero nulo en hci_uart_write_work\n\nhci_uart_set_proto() establece HCI_UART_PROTO_INIT antes de llamar a hci_uart_register_dev(), que llama a proto->open() para inicializar hu->priv. Sin embargo, si una activación de escritura TTY ocurre durante esta ventana, hci_uart_tx_wakeup() puede programar write_work antes de que hu->priv sea inicializado, lo que lleva a una desreferencia de puntero NULL en hci_uart_write_work() cuando proto->dequeue() accede a hu->priv.\n\nLa condición de carrera es:\n\n CPU0 CPU1\n ---- ----\n hci_uart_set_proto()\n set_bit(HCI_UART_PROTO_INIT)\n hci_uart_register_dev()\n activación de escritura tty\n hci_uart_tty_wakeup()\n hci_uart_tx_wakeup()\n schedule_work(&hu->write_work)\n proto->open(hu)\n // inicializa hu->priv\n hci_uart_write_work()\n hci_uart_dequeue()\n proto->dequeue(hu)\n // accede a hu->priv (¡NULL!)\n\nEsto se soluciona moviendo set_bit(HCI_UART_PROTO_INIT) después de que proto->open() se complete con éxito, asegurando que hu->priv esté inicializado antes de que se pueda programar cualquier trabajo."
}
],
"lastModified": "2026-06-17T10:20:59.047",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D6F83CA-7E5C-4A91-9D8C-71CC85535E7D",
"versionEndExcluding": "5.5",
"versionStartIncluding": "5.4.293"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "339F6FF4-79D2-49BC-9E0D-68FB6F1201E9",
"versionEndExcluding": "5.10.249",
"versionStartIncluding": "5.10.237"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FDF3BBC9-1D58-4300-AD4C-591A4919AAC0",
"versionEndExcluding": "5.15.199",
"versionStartIncluding": "5.15.181"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B08612A5-165F-449C-B5B5-6830D99A6A48",
"versionEndExcluding": "6.1.162",
"versionStartIncluding": "6.1.135"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D79ED79-3597-4CCE-95EF-DED9FD319AA1",
"versionEndExcluding": "6.6.123",
"versionStartIncluding": "6.6.88"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8AE027B-66A3-434F-AC67-50F44A6A41EF",
"versionEndExcluding": "6.12.69",
"versionStartIncluding": "6.12.24"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A1F1E5FF-68CB-46CE-BC4F-8E19FA72A921",
"versionEndExcluding": "6.14",
"versionStartIncluding": "6.13.12"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0FBCCA71-8616-4922-B963-927778DB4B44",
"versionEndExcluding": "6.18.9",
"versionStartIncluding": "6.14.3"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}