CVE-2026-89569
Received Received - Intake

Bluetooth Use-After-Free in Linux Kernel RFCOMM

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcomm_security_cfm() looks up a session on session_list and then walks its DLC list without holding rfcomm_mutex. Since RFCOMM session teardown uses rfcomm_mutex, krfcommd can close and free the same session and DLCs concurrently: hci_rx_work krfcommd ----------- --------- rfcomm_session_get() rfcomm_lock() rfcomm_session_close() rfcomm_dlc_unlink() rfcomm_session_del() kfree(s) rfcomm_unlock() walk s->dlcs The callback can then read a freed session list head and touch freed DLCs while updating their flags or timers. Serialize the session lookup and DLC traversal in rfcomm_security_cfm() with rfcomm_mutex. This matches the existing RFCOMM session lifetime rules and prevents concurrent rfcomm_session_del() / rfcomm_dlc_unlink() from tearing the objects down while the callback is using them. KASAN reported: BUG: KASAN: slab-use-after-free in rfcomm_security_cfm+0x41c/0x440 Read of size 8 at addr ffff888111fb3960 by task kworker/u17:1/89 Workqueue: hci0 hci_rx_work Call Trace: rfcomm_security_cfm+0x41c/0x440 hci_encrypt_cfm+0x139/0x590 hci_encrypt_change_evt+0x37b/0xc40 hci_event_packet+0x71b/0xb20 hci_rx_work+0x293/0x730 Allocated by task 69: rfcomm_session_add+0x9e/0x2f0 rfcomm_run+0x44b/0x41e0 Freed by task 69: kfree+0x131/0x3c0 rfcomm_session_del+0x188/0x220 rfcomm_run+0x1985/0x41e0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89569
EUVD
EUVD-2026-76480

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's Bluetooth RFCOMM subsystem. It occurs when the rfcomm_security_cfm() function accesses Bluetooth session and DLC objects that have been freed by another process (krfcommd) while they were still in use. The issue arises because rfcomm_security_cfm() does not properly synchronize access to these objects with the mutex that controls their lifetime.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth RFCOMM implementation and may be detected by checking kernel logs for KASAN reports or slab-use-after-free errors related to rfcomm_security_cfm. Monitor system logs for crashes or warnings during Bluetooth operations.

Impact Analysis

This vulnerability could allow an attacker in Bluetooth range to cause a kernel crash (denial of service) or potentially execute arbitrary code with kernel privileges. It may also lead to memory corruption or other unpredictable system behavior on affected Linux systems using Bluetooth.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. If immediate patching is not possible, consider disabling Bluetooth functionality temporarily until the patch is applied to prevent potential exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89569. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart