CVE-2026-97975

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs when child network devices are unregistered concurrently while Bluetooth connection cleanup routines reparent child devices. A local user can exploit this timing issue to trigger a NULL pointer dereference, resulting in a kernel crash and a Denial of Service (DoS).

A race in Bluetooth hci_conn_del_sysfs can occur when a child device is being unregistered while the connection cleanup path reparents child devices. A BNEP network device can be removed from its parent klist by device_move while device_del still uses a stale parent state, resulting in a NULL pointer dereference in klist_put and a kernel crash. The missing explicit reference from the connection device to the HCI parent device also creates a stale device lifetime reference and an underlying use after free candidate. For the CVSS the PR:N is used because a nearby Bluetooth peer may trigger the affected BNEP connection and teardown activity without local code execution on the target. The attack vector is adjacent because Bluetooth communication requires radio proximity. The race requires timing control and therefore AC:H. Impact is at least denial of service via kernel crash and in the worst case may allow limited confidentiality or integrity impact due to the device lifetime use after free condition. This issue should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.