Executive brief
A race condition vulnerability was identified in the Linux kernel's Bluetooth RFCOMM implementation. This flaw could allow a local attacker to cause a system crash or potentially execute unauthorized code by exploiting a timing issue when a Bluetooth connection is established at the same time a socket is being closed. This primarily impacts system stability and availability.
Technical details
A use-after-free vulnerability exists in net/bluetooth/rfcomm/sock.c due to a race condition between rfcomm_connect_ind() and socket release. The function rfcomm_get_sock_by_channel() scans the rfcomm_sk_list and returns a listener socket without incrementing its reference count. If the listener socket is closed and freed via rfcomm_sock_kill() before rfcomm_connect_ind() can lock it, a slab-use-after-free occurs in lock_sock_nested(). The fix involves taking a proper reference on the listener socket while holding the list lock and verifying the socket state after re-locking.
Affected products
- Linux Linux Kernel 2.6.12-rc2 to 6.14
Timeline
- 2026-05-28: other: Vulnerability reported by Zhang Cen
- 2026-06-19: patched: Fix committed to stable kernel trees
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1f73f92f66251065a5f39b09a47cf05ea14d3107
- https://git.kernel.org/stable/c/43c441edacf953b39517a44f5e5e10a93618b226
- https://git.kernel.org/stable/c/6f4462d12133106460d7c046b95aad2491e3fddf
- https://git.kernel.org/stable/c/8802413ce63175fb522a2bd609fb043a3550c720
- https://git.kernel.org/stable/c/a07d741c077d4e34b16458241a94d29039386553
- https://git.kernel.org/stable/c/b0e33e409715c617e2a20f46f99aa5403a14dfda
- https://git.kernel.org/stable/c/de31973ef00e5aa55496f84cf6a44bb157a34e02