Executive brief
A race condition in the Linux kernel's Bluetooth RFCOMM (serial emulation protocol) implementation could allow an attacker with Bluetooth connectivity to crash the system or potentially execute code. The vulnerability occurs during session teardown, where a callback function may access freed memory while another thread is cleaning up the session.
Technical details
The vulnerability is a use-after-free race condition in the rfcomm_security_cfm() callback function. The callback performs an unsynchronized lookup of an RFCOMM session and walks its DLC (data link control) list without holding the rfcomm_mutex lock. Concurrently, krfcommd can close and free the same session and DLCs, causing the callback to read from freed session list heads and access freed DLC structures. The fix serializes the session lookup and DLC traversal in rfcomm_security_cfm() with rfcomm_mutex to prevent concurrent teardown. Attack requires Bluetooth connectivity to the target system and occurs during the security confirmation phase of RFCOMM connection establishment.
Affected products
- Linux Linux kernel affected versions prior to patch
Timeline
- 2026-09-11: disclosed
- patched: Fix serializes session lookup and DLC traversal with rfcomm_mutex