CVE-2026-23146: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23146 is a NULL pointer dereference vulnerability in the Linux kernel's Bluetooth HCI UART driver (hci_uart) that can cause a kernel crash and denial of service. It was published on February 14, 2026, and affects multiple stable Linux kernel branches including 5.4.293–5.5, 5.10.237–5.10.249, 5.15.181–5.15.199, 6.1.135–6.1.162, 6.6.88–6.6.123, 6.12.24–6.12.69, 6.13.12–6.14, 6.14.3–6.18.9, and 6.19 release candidates. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a race condition (CWE-476: NULL Pointer Dereference) in hci_uart_set_proto(), where the HCI_UART_PROTO_INIT flag is set before hci_uart_register_dev() calls proto->open() to initialize hu->priv. If a TTY write wakeup event occurs during this initialization window, hci_uart_tty_wakeup() schedules write_work before hu->priv is populated. When hci_uart_write_work() subsequently executes and calls proto->dequeue(), it dereferences the uninitialized (NULL) hu->priv pointer, triggering a kernel panic. The fix moves the set_bit(HCI_UART_PROTO_INIT) call to after proto->open() succeeds, closing the race window (Feedly, Kernel Patch).

Successful exploitation results in a kernel NULL pointer dereference crash, causing a denial of service that disrupts system stability and disables Bluetooth functionality. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Because the crash occurs in kernel space, it affects the entire system, not just a single process or user session (Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of this report. The vulnerability requires local access with low privileges and no user interaction, making it accessible to any unprivileged local user on an affected system with a Bluetooth HCI UART device. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

Patches are available via the upstream Linux kernel stable tree across multiple branches. Administrators should update to fixed kernel versions: 5.4.x (before 5.5), 5.10.x (before 5.10.249), 5.15.x (before 5.15.199), 6.1.x (before 6.1.162), 6.6.x (before 6.6.123), 6.12.x (before 6.12.69), and 6.14+ (before 6.18.9). Distribution-specific updates have been issued by Ubuntu (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1, USN-8393-1), Oracle Linux, and Rocky Linux. As a temporary workaround, disabling or restricting local access to Bluetooth HCI UART devices can reduce exposure while patches are applied (Feedly, Ubuntu USN-8162-1, Kernel Patch).