CVE-2026-98739
Received Received - Intake

Use-After-Free in Linux Kernel Bluetooth RFCOMM

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and __rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the initial tty_port reference. The release path tests the bit separately from the install path setting it, so both can drop that reference. The synchronous hangup does not prevent this race: port->tty is not assigned until tty_port_open(), after installation. The following interleaving is possible: 1. Install and release each obtain a reference with rfcomm_dev_get(). 2. Release observes RFCOMM_TTY_OWNED clear. 3. Install sets RFCOMM_TTY_OWNED and drops the initial reference. 4. Release drops the same initial reference again. 5. TTY cleanup drops its reference and frees the device. 6. Release performs its final tty_port_put() on the freed port. KASAN reported: BUG: KASAN: slab-use-after-free in tty_port_put+0x22/0x190 Write of size 4 at addr ffff8881001d3d5c by task poc/92 Call Trace: tty_port_put+0x22/0x190 rfcomm_dev_ioctl+0x1d4/0x1930 sock_do_ioctl+0x110/0x260 sock_ioctl+0x380/0x590 __x64_sys_ioctl+0x134/0x1c0 Allocated by task 88: rfcomm_dev_ioctl+0x8f6/0x1930 sock_do_ioctl+0x110/0x260 sock_ioctl+0x380/0x590 __x64_sys_ioctl+0x134/0x1c0 Freed by task 65: kfree+0x131/0x3c0 rfcomm_dev_destruct+0x23b/0x2f0 release_one_tty+0xc1/0x370 process_one_work+0x661/0x1090 Use test_and_set_bit() in both paths so that only the caller that changes RFCOMM_TTY_OWNED from clear to set drops the initial reference. Each path keeps its own lookup reference until release or TTY cleanup, preserving the existing callback ordering and error handling.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98739
EUVD
EUVD-2026-103824

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 80ea73378af46b0023eb2f400d26c2a60248ffaa
Linux Linux 80ea73378af46b0023eb2f400d26c2a60248ffaa
Linux Linux 80ea73378af46b0023eb2f400d26c2a60248ffaa
Linux Linux 80ea73378af46b0023eb2f400d26c2a60248ffaa
Linux Linux 3.15

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition in the Linux kernel's Bluetooth RFCOMM subsystem. It occurs when two processes, one installing a tty port and another releasing it, both try to drop the initial reference count on the same port. The race leads to a use-after-free vulnerability where memory is freed while still being accessed, causing a kernel crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth RFCOMM subsystem and may not have direct network detection methods. Check kernel logs for KASAN errors or slab-use-after-free messages related to tty_port_put. Monitor system crashes or unexpected behavior in Bluetooth operations.

Impact Analysis

This vulnerability can cause system instability or crashes due to kernel memory corruption. An attacker with local access could exploit this to trigger a denial-of-service condition, potentially leading to system reboot or kernel panic. It does not allow arbitrary code execution or privilege escalation.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Disable Bluetooth services if not needed. Monitor kernel updates from your distribution vendor and update promptly. Restrict Bluetooth device access if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98739. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart