CVE-2026-23146 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should assess exposure and prioritize verification of affected versions. Affected Linux kernel deployments require operator, platform, vulnerability-management, and security-team impact review. Linux distributions and package maintainers may need to provide updates. Security teams should monitor for potential exploitation attempts and verify affected versions.

Why it matters

A null pointer dereference vulnerability was found in the Linux kernel's Bluetooth hci_uart module. This vulnerability can lead to a denial of service or potentially allow an attacker to execute arbitrary code. Linux kernel maintainers and users should assess exposure and prioritize verification of affected versions.

• Verify affected versions and assess exposure
• Monitor for potential exploitation attempts
• Apply patches from Linux kernel maintainers

Technical summary

The vulnerability is caused by a race condition between hci_uart_set_proto() and hci_uart_register_dev(). hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling hci_uart_register_dev(), which calls proto->open() to initialize hu->priv. However, if a TTY write wakeup occurs during this window, hci_uart_tx_wakeup() may schedule write_work before hu->priv is initialized, leading to a null pointer dereference in hci_uart_write_work() when proto->dequeue() accesses hu->priv.

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize verification of affected versions.

Recommended defensive actions

• Review and apply patches from Linux kernel maintainers
• Verify affected versions and assess exposure
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details about the vulnerability, including a description of the issue and references to affected versions. Linux kernel maintainers and users should verify affected versions, assess exposure, and prioritize verification. The vulnerability is caused by a race condition between hci_uart_set_proto() and hci_uart_register_dev(). Evidence is limited to CVE Program and supplemental references.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.