---
id: CVE-2026-99008
title: 'Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown

  syzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an
  RFCOMM tty is closed.

  rf…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= cad348a17e170451ea8688b532a6ca3e98c63b60 <
    d5c372ad03330f02962d4860df4d355ab25487df
  - >-
    Linux >= cad348a17e170451ea8688b532a6ca3e98c63b60 <
    3fd5164bdb04635caa7942ddb554b0ec699a9433
  - >-
    Linux >= cad348a17e170451ea8688b532a6ca3e98c63b60 <
    a661f401f83b8462f2d424e0a1a72b7681e92ea2
  - >-
    Linux >= cad348a17e170451ea8688b532a6ca3e98c63b60 <
    d0aef0b0374678153244f162df507106d728af39
  - >-
    Linux >= cad348a17e170451ea8688b532a6ca3e98c63b60 <
    08e90633377f1b2567ab5ad6810b74c552246a07
  - Linux 3.12
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:20:33.355Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99008'
references:
  - url: 'https://git.kernel.org/stable/c/d5c372ad03330f02962d4860df4d355ab25487df'
  - url: 'https://git.kernel.org/stable/c/3fd5164bdb04635caa7942ddb554b0ec699a9433'
  - url: 'https://git.kernel.org/stable/c/a661f401f83b8462f2d424e0a1a72b7681e92ea2'
  - url: 'https://git.kernel.org/stable/c/d0aef0b0374678153244f162df507106d728af39'
  - url: 'https://git.kernel.org/stable/c/08e90633377f1b2567ab5ad6810b74c552246a07'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.539Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown

syzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an
RFCOMM tty is closed.

rfcomm_dev_add() puts the new device on rfcomm_dev_list first and only
then registers the tty device and saves it in dev->tty_dev. If that
registration fails, dev->tty_dev is never set at all. The device can be
looked up in the meantime, so an open() of /dev/rfcommN gets through
rfcomm_tty_install() and attaches to it. When that tty is closed again,
rfcomm_dev_shutdown() uses dev->tty_dev without checking it:

  Oops: general protection fault, probably for non-canonical address
  KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
  RIP: 0010:rfcomm_dev_shutdown+0x48/0xb0 net/bluetooth/rfcomm/tty.c:131
  Call Trace:
   tty_port_shutdown+0x1bf/0x220 drivers/tty/tty_port.c:372
   tty_port_close+0x4e/0x150 drivers/tty/tty_port.c:705
   tty_release+0x359/0x1670 drivers/tty/tty_io.c:1718
   __fput+0x418/0xa50 fs/file_table.c:512

rfcomm_dev_destruct() already copes with a NULL dev->tty_dev. Add the
same check to rfcomm_dev_shutdown(), so the tty device is only moved
when it was actually registered.

## Affected

- `Linux >= cad348a17e170451ea8688b532a6ca3e98c63b60 < d5c372ad03330f02962d4860df4d355ab25487df`
- `Linux >= cad348a17e170451ea8688b532a6ca3e98c63b60 < 3fd5164bdb04635caa7942ddb554b0ec699a9433`
- `Linux >= cad348a17e170451ea8688b532a6ca3e98c63b60 < a661f401f83b8462f2d424e0a1a72b7681e92ea2`
- `Linux >= cad348a17e170451ea8688b532a6ca3e98c63b60 < d0aef0b0374678153244f162df507106d728af39`
- `Linux >= cad348a17e170451ea8688b532a6ca3e98c63b60 < 08e90633377f1b2567ab5ad6810b74c552246a07`
- `Linux 3.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.