CVE-2026-97977 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, especially those using Bluetooth, should assess exposure and prioritize patching or mitigation. This includes operators managing Linux-based infrastructure, platform administrators, vulnerability management teams, and security teams responsible for monitoring and incident response.

Why it matters

Defenders should prioritize patching or mitigating CVE-2026-97977 due to the potential for system instability or unauthorized access. Linux kernel-based systems using Bluetooth are at risk and require verification of exposure and potential exploitation.

• Potential system crashes or instability due to use-after-free condition
• Possible elevation of privileges or unauthorized access
• Required verification of affected versions and exploitation
• Need for patching or mitigation to prevent potential exploitation

Technical summary

The Linux kernel's Bluetooth subsystem, specifically the btusb module, is vulnerable to a use-after-free condition. This occurs when btusb_close() or btusb_flush() is called, and they cancel the rx_work delayed work with asynchronous cancel_delayed_work(). If btusb_rx_work() is running on another CPU, it continues to run after the cancel returns, leading to a potential use-after-free condition when btusb_disconnect() calls hci_unregister_dev(), which invokes btusb_close(), and then frees the btusb_data.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in systems using Bluetooth.

Recommended defensive actions

• Patch or update the Linux kernel to the latest version
• Implement additional monitoring and logging to detect potential exploitation attempts
• Review and update Bluetooth-related configurations and settings
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the impact and affected versions require further verification from official sources. Linux kernel-based systems using Bluetooth are at risk and require verification of exposure and potential exploitation. Defenders should verify affected versions, configurations, and potential exploitation attempts. Official advisories and CVE details should be reviewed for accurate information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.