---
id: CVE-2026-23146
title: 'Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work

  hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling
  hci_uart_register_dev(), which calls proto-…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a40f94f7caa8d3421b64f63ac31bc0f24c890f39 <
    b0a900939e7e4866d9b90e9112514b72c451e873
  - >-
    Linux >= 9e5a0f5777162e503400c70c6ed25fbbe2d38799 <
    ccc683f597ceb28deb966427ae948e5ac739a909
  - >-
    Linux >= 80f14e9de6a43a0bd8194cad1003a3e6dcbc3984 <
    937a573423ce5a96fdb1fd425dc6b8d8d4ab5779
  - >-
    Linux >= 02e1bcdfdf769974e7e9fa285e295cd9852e2a38 <
    186d147cf7689ba1f9b3ddb753ab634a84940cc9
  - >-
    Linux >= 281782d2c6730241e300d630bb9f200d831ede71 <
    53e54cb31e667fca05b1808b990eac0807d1dab0
  - >-
    Linux >= 5df5dafc171b90d0b8d51547a82657cd5a1986c7 <
    03e8c90c62233382042b7bd0fa8b8900552fdb62
  - >-
    Linux >= 5df5dafc171b90d0b8d51547a82657cd5a1986c7 <
    0c3cd7a0b862c37acbee6d9502107146cc944398
  - Linux 1dcf08fcff5ca529de6dc0395091f28854f4e54a
  - Linux 8e5aff600539e5faea294d9612cca50220e602b8
  - Linux db7509fa110dd9b11134b75894677f30353b2c51
  - Linux >= 5.10.237 < 5.10.249
  - Linux >= 5.15.181 < 5.15.199
  - Linux >= 6.1.135 < 6.1.162
  - Linux >= 6.6.88 < 6.6.123
  - Linux >= 6.12.24 < 6.12.69
  - Linux >= 5.4.293 < 5.5
  - Linux >= 6.13.12 < 6.14
  - Linux >= 6.14.3 < 6.15
  - Linux 6.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-10T20:41:53.104941Z'
published: '2026-02-14'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:25:33.428Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23146'
references:
  - url: 'https://git.kernel.org/stable/c/b0a900939e7e4866d9b90e9112514b72c451e873'
  - url: 'https://git.kernel.org/stable/c/ccc683f597ceb28deb966427ae948e5ac739a909'
  - url: 'https://git.kernel.org/stable/c/937a573423ce5a96fdb1fd425dc6b8d8d4ab5779'
  - url: 'https://git.kernel.org/stable/c/186d147cf7689ba1f9b3ddb753ab634a84940cc9'
  - url: 'https://git.kernel.org/stable/c/53e54cb31e667fca05b1808b990eac0807d1dab0'
  - url: 'https://git.kernel.org/stable/c/03e8c90c62233382042b7bd0fa8b8900552fdb62'
  - url: 'https://git.kernel.org/stable/c/0c3cd7a0b862c37acbee6d9502107146cc944398'
tags:
  - cve.org
epss: 0.00144
epssPercentile: 0.033
ingestedAt: '2026-10-19T18:35:50.100Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work

hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling
hci_uart_register_dev(), which calls proto->open() to initialize
hu->priv. However, if a TTY write wakeup occurs during this window,
hci_uart_tx_wakeup() may schedule write_work before hu->priv is
initialized, leading to a NULL pointer dereference in
hci_uart_write_work() when proto->dequeue() accesses hu->priv.

The race condition is:

  CPU0                              CPU1
  ----                              ----
  hci_uart_set_proto()
    set_bit(HCI_UART_PROTO_INIT)
    hci_uart_register_dev()
                                    tty write wakeup
                                      hci_uart_tty_wakeup()
                                        hci_uart_tx_wakeup()
                                          schedule_work(&hu->write_work)
      proto->open(hu)
        // initializes hu->priv
                                    hci_uart_write_work()
                                      hci_uart_dequeue()
                                        proto->dequeue(hu)
                                          // accesses hu->priv (NULL!)

Fix this by moving set_bit(HCI_UART_PROTO_INIT) after proto->open()
succeeds, ensuring hu->priv is initialized before any work can be
scheduled.

## Affected

- `Linux >= a40f94f7caa8d3421b64f63ac31bc0f24c890f39 < b0a900939e7e4866d9b90e9112514b72c451e873`
- `Linux >= 9e5a0f5777162e503400c70c6ed25fbbe2d38799 < ccc683f597ceb28deb966427ae948e5ac739a909`
- `Linux >= 80f14e9de6a43a0bd8194cad1003a3e6dcbc3984 < 937a573423ce5a96fdb1fd425dc6b8d8d4ab5779`
- `Linux >= 02e1bcdfdf769974e7e9fa285e295cd9852e2a38 < 186d147cf7689ba1f9b3ddb753ab634a84940cc9`
- `Linux >= 281782d2c6730241e300d630bb9f200d831ede71 < 53e54cb31e667fca05b1808b990eac0807d1dab0`
- `Linux >= 5df5dafc171b90d0b8d51547a82657cd5a1986c7 < 03e8c90c62233382042b7bd0fa8b8900552fdb62`
- `Linux >= 5df5dafc171b90d0b8d51547a82657cd5a1986c7 < 0c3cd7a0b862c37acbee6d9502107146cc944398`
- `Linux 1dcf08fcff5ca529de6dc0395091f28854f4e54a`
- `Linux 8e5aff600539e5faea294d9612cca50220e602b8`
- `Linux db7509fa110dd9b11134b75894677f30353b2c51`
- `Linux >= 5.10.237 < 5.10.249`
- `Linux >= 5.15.181 < 5.15.199`
- `Linux >= 6.1.135 < 6.1.162`
- `Linux >= 6.6.88 < 6.6.123`
- `Linux >= 6.12.24 < 6.12.69`
- `Linux >= 5.4.293 < 5.5`
- `Linux >= 6.13.12 < 6.14`
- `Linux >= 6.14.3 < 6.15`
- `Linux 6.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.