{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46275", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.109Z", "datePublished": "2026-06-08T14:30:54.232Z", "dateUpdated": "2026-06-14T18:05:39.086Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-14T18:05:39.086Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_uart: fix UAFs and race conditions in close and init paths\n\nVulnerabilities leading to Use-After-Free (UAF) and Null Pointer\nDereference (NPD) conditions were observed in the lifecycle management\nof hci_uart.\n\nThe primary issue arises because the workqueues (init_ready and\nwrite_work) are only flushed/cancelled if the HCI_UART_PROTO_READY\nflag is set during TTY close. If a hangup occurs before setup completes,\nhci_uart_tty_close() skips the teardown of these workqueues and\nproceeds to free the `hu` struct. When the scheduled work executes\nlater, it blindly dereferences the freed `hu` struct.\n\nFurthermore, several data races and UAFs were identified in the teardown\nsequence:\n1. Calling hci_uart_flush() from hci_uart_close() without effectively\n disabling write_work causes a race condition where both can concurrently\n double-free hu->tx_skb. This happens because protocol timers can\n concurrently invoke hci_uart_tx_wakeup() and requeue write_work.\n2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF\n when vendor specific protocol close callbacks dereference hu->hdev.\n3. In the initialization error paths, failing to take the proto_lock\n write lock before clearing PROTO_READY leads to races with active\n readers. Additionally, hci_uart_tty_receive() accesses hu->hdev\n outside the read lock, leading to UAFs if the initialization error\n path frees hdev concurrently.\n\nFix these synchronization and lifecycle issues by:\n1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first,\n followed immediately by a cancel_work_sync(&hu->write_work). Clearing\n the flag locks out concurrent protocol timers from successfully invoking\n hci_uart_tx_wakeup(), effectively rendering the cancellation permanent\n and preventing the tx_skb double-free.\n2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip\n hu->proto->flush(). This is perfectly safe in the tty_close path\n because hu->proto->close() executes shortly after, which intrinsically\n purges all protocol SKB queues and tears down the state.\n3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev)\n across all close and error paths to prevent vendor-level UAFs.\n4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive()\n inside the proto_lock read-side critical section to safely synchronize\n with device unregistration.\n5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely\n flush the workqueue before hci_uart_flush() is invoked via the HCI core.\n6. Utilizing cancel_work_sync() instead of disable_work_sync() across\n all paths to prevent permanently breaking user-space retry capabilities."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/hci_ldisc.c"], "versions": [{"version": "3b799254cf6f481460719023d7a18f46651e5e7f", "lessThan": "78aad93e938f013d9272fe0ee168f27883afa95c", "status": "affected", "versionType": "git"}, {"version": "3b799254cf6f481460719023d7a18f46651e5e7f", "lessThan": "e2d19969c8d9198ecc3090bcd5312ecd503a3339", "status": "affected", "versionType": "git"}, {"version": "3b799254cf6f481460719023d7a18f46651e5e7f", "lessThan": "c85cff648a2bc92322912db5f1727ad05afae7b6", "status": "affected", "versionType": "git"}, {"version": "3b799254cf6f481460719023d7a18f46651e5e7f", "lessThan": "9d20d48be2c4a071fb015eb09bda2cecd25daf34", "status": "affected", "versionType": "git"}, {"version": "3b799254cf6f481460719023d7a18f46651e5e7f", "lessThan": "81c7a3c22a0f2808cf4ae0b4908f59763b23606d", "status": "affected", "versionType": "git"}, {"version": "3b799254cf6f481460719023d7a18f46651e5e7f", "lessThan": "192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894", "status": "affected", "versionType": "git"}, {"version": "3b799254cf6f481460719023d7a18f46651e5e7f", "lessThan": "7338031946bd06f6dff149e67b60c4cd083bfea8", "status": "affected", "versionType": "git"}, {"version": "3b799254cf6f481460719023d7a18f46651e5e7f", "lessThan": "c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b", "status": "affected", "versionType": "git"}, {"version": "cd27019bc149f20f12ebec943c2b4c775745a5a0", "status": "affected", "versionType": "git"}, {"version": "aea63181b6fcb6b9ccde1ada9ea51be19c4015af", "status": "affected", "versionType": "git"}, {"version": "0d234d1135dcd8876de0576dac68efd0a87eef87", "status": "affected", "versionType": "git"}, {"version": "3fe978892ab46efc2f3830d9abc015eff72caaf9", "status": "affected", "versionType": "git"}, {"version": "0d987e14bebaf0f67ee7dbefaf6165c62cd1d27f", "status": "affected", "versionType": "git"}, {"version": "4.14.203", "lessThan": "4.15", "status": "affected", "versionType": "semver"}, {"version": "4.19.153", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.73", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "5.8.17", "lessThan": "5.9", "status": "affected", "versionType": "semver"}, {"version": "5.9.2", "lessThan": "5.10", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/hci_ldisc.c"], "versions": [{"version": "5.10", "status": "affected"}, {"version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.142", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.92", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.142"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.12.92"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.153"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.73"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/78aad93e938f013d9272fe0ee168f27883afa95c"}, {"url": "https://git.kernel.org/stable/c/e2d19969c8d9198ecc3090bcd5312ecd503a3339"}, {"url": "https://git.kernel.org/stable/c/c85cff648a2bc92322912db5f1727ad05afae7b6"}, {"url": "https://git.kernel.org/stable/c/9d20d48be2c4a071fb015eb09bda2cecd25daf34"}, {"url": "https://git.kernel.org/stable/c/81c7a3c22a0f2808cf4ae0b4908f59763b23606d"}, {"url": "https://git.kernel.org/stable/c/192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894"}, {"url": "https://git.kernel.org/stable/c/7338031946bd06f6dff149e67b60c4cd083bfea8"}, {"url": "https://git.kernel.org/stable/c/c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b"}], "title": "Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_uart: fix UAFs and race conditions in close and init paths\n\nVulnerabilities leading to Use-After-Free (UAF) and Null Pointer\nDereference (NPD) conditions were observed in the lifecycle management\nof hci_uart.\n\nThe primary issue arises because the workqueues (init_ready and\nwrite_work) are only flushed/cancelled if the HCI_UART_PROTO_READY\nflag is set during TTY close. If a hangup occurs before setup completes,\nhci_uart_tty_close() skips the teardown of these workqueues and\nproceeds to free the `hu` struct. When the scheduled work executes\nlater, it blindly dereferences the freed `hu` struct.\n\nFurthermore, several data races and UAFs were identified in the teardown\nsequence:\n1. Calling hci_uart_flush() from hci_uart_close() without effectively\n disabling write_work causes a race condition where both can concurrently\n double-free hu->tx_skb. This happens because protocol timers can\n concurrently invoke hci_uart_tx_wakeup() and requeue write_work.\n2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF\n when vendor specific protocol close callbacks dereference hu->hdev.\n3. In the initialization error paths, failing to take the proto_lock\n write lock before clearing PROTO_READY leads to races with active\n readers. Additionally, hci_uart_tty_receive() accesses hu->hdev\n outside the read lock, leading to UAFs if the initialization error\n path frees hdev concurrently.\n\nFix these synchronization and lifecycle issues by:\n1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first,\n followed immediately by a cancel_work_sync(&hu->write_work). Clearing\n the flag locks out concurrent protocol timers from successfully invoking\n hci_uart_tx_wakeup(), effectively rendering the cancellation permanent\n and preventing the tx_skb double-free.\n2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip\n hu->proto->flush(). This is perfectly safe in the tty_close path\n because hu->proto->close() executes shortly after, which intrinsically\n purges all protocol SKB queues and tears down the state.\n3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev)\n across all close and error paths to prevent vendor-level UAFs.\n4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive()\n inside the proto_lock read-side critical section to safely synchronize\n with device unregistration.\n5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely\n flush the workqueue before hci_uart_flush() is invoked via the HCI core.\n6. Utilizing cancel_work_sync() instead of disable_work_sync() across\n all paths to prevent permanently breaking user-space retry capabilities."}], "id": "CVE-2026-46275", "lastModified": "2026-06-14T06:16:22.753", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-06-08T16:16:40.863", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7338031946bd06f6dff149e67b60c4cd083bfea8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/78aad93e938f013d9272fe0ee168f27883afa95c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/81c7a3c22a0f2808cf4ae0b4908f59763b23606d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9d20d48be2c4a071fb015eb09bda2cecd25daf34"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c85cff648a2bc92322912db5f1727ad05afae7b6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e2d19969c8d9198ecc3090bcd5312ecd503a3339"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths", "id": "2486398", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486398"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's Bluetooth hci_uart component. Lifecycle management issues, including Use-After-Free (UAF) and race conditions, were identified during the closing and initialization paths. These issues can lead to the dereferencing of freed memory, potentially causing system instability, crashes, or arbitrary code execution."], "name": "CVE-2026-46275", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46275\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46275\nhttps://lore.kernel.org/linux-cve-announce/2026060803-CVE-2026-46275-9af6@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b799254cf6f481460719023d7a18f46651e5e7f,78aad93e938f013d9272fe0ee168f27883afa95c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b799254cf6f481460719023d7a18f46651e5e7f,e2d19969c8d9198ecc3090bcd5312ecd503a3339)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b799254cf6f481460719023d7a18f46651e5e7f,c85cff648a2bc92322912db5f1727ad05afae7b6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b799254cf6f481460719023d7a18f46651e5e7f,9d20d48be2c4a071fb015eb09bda2cecd25daf34)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b799254cf6f481460719023d7a18f46651e5e7f,81c7a3c22a0f2808cf4ae0b4908f59763b23606d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b799254cf6f481460719023d7a18f46651e5e7f,192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b799254cf6f481460719023d7a18f46651e5e7f,7338031946bd06f6dff149e67b60c4cd083bfea8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b799254cf6f481460719023d7a18f46651e5e7f,c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "cd27019bc149f20f12ebec943c2b4c775745a5a0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "aea63181b6fcb6b9ccde1ada9ea51be19c4015af"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "0d234d1135dcd8876de0576dac68efd0a87eef87"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "3fe978892ab46efc2f3830d9abc015eff72caaf9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "0d987e14bebaf0f67ee7dbef6165c62cd1d27f"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.14.203,4.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.19.153,4.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.4.73,5.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.8.17,5.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.9.2,5.10)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.258,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.209,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.175,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.142,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.92,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.34,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0.11,7.0.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-08T17:00:16.995654+00:00", "updated": "2026-06-14T07:00:17.864240+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}