CVE-2026-99008 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux systems with Bluetooth support should assess exposure and apply patches as necessary. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed to ensure proper mitigation.

Why it matters

A NULL pointer dereference vulnerability in the Linux kernel's Bluetooth RFCOMM implementation requires verification of exposure and application of patches to prevent potential DoS attacks.

• Denial-of-service (DoS) attacks may be possible if an attacker can trigger the NULL pointer dereference.
• Verification of Linux kernel versions and application of patches is necessary to prevent potential exploitation.
• Exposure exists for systems using affected Linux kernel versions with Bluetooth support enabled.

Technical summary

The Linux kernel's Bluetooth RFCOMM implementation has a NULL pointer dereference vulnerability. When an RFCOMM tty is closed, the `rfcomm_dev_shutdown` function uses `dev->tty_dev` without checking if it is NULL. This can occur if the registration of the tty device fails, leaving `dev->tty_dev` unset. An attacker could potentially exploit this vulnerability to cause a denial-of-service condition.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the available stable kernel updates to ensure the fix is applied.
• Monitor Linux kernel versions for updates and apply patches as necessary.
• Verify that affected systems have the fix applied and are not vulnerable.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was resolved by adding a check for NULL `dev->tty_dev` in `rfcomm_dev_shutdown`. The fix is available in the Linux kernel stable updates. Evidence of the fix includes the Linux kernel stable updates and the CVE record. The CVE record was published on 2026-10-23T12:20:33.355Z and has not been modified since then. The vulnerability affects Linux kernel versions with Bluetooth support enabled. There is no evidence of public exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.