Executive brief
A defect in the Linux kernel's Bluetooth RFCOMM protocol stack can cause a system crash when a remote device sends a disconnection signal during a deferred socket setup. This affects systems using Bluetooth file transfer or serial emulation over BR/EDR connections and can be exploited to cause a denial of service without authentication.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the rfcomm_dlc_accept() function. The root cause is a missing lock (rfcomm_mutex) when processing a deferred setup accept in rfcomm_sock_recvmsg(). When a remote DISC (disconnection) is received on a deferred DLC, the session is cleared (d->session = NULL) while the RFCOMM_DEFER_SETUP bit remains set. A subsequent recvmsg() call passes the bit test and unconditionally dereferences the NULL session pointer, triggering a general protection fault. The attack requires an adjacent Bluetooth connection and the target socket bound with BT_DEFER_SETUP, but no timing window—exploitation is deterministic once DISC is processed. The fix adds proper mutex protection and session validity checks, mirroring the pattern used in rfcomm_dlc_open() and rfcomm_dlc_close().
Affected products
- Linux Linux kernel multiple versions (specific range not disclosed)
Timeline
- 2026-09-04: disclosed: Published on NVD