EUVD-2026-76480
GHSA-xxfx-9m42-x999
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Race condition requires precise timing (AC:H); Bluetooth adjacency limits reach (AV:A); no kernel-level credential needed once HCI-adjacent (PR:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: serialize security confirmation handling
rfcomm_security_cfm() looks up a session on session_list and then walks its DLC list without holding rfcomm_mutex. Since RFCOMM session teardown uses rfcomm_mutex, krfcommd can close and free the same session and DLCs concurrently:
hci_rx_work krfcommd ----------- --------- rfcomm_session_get() rfcomm_lock() rfcomm_session_close() rfcomm_dlc_unlink() rfcomm_session_del() kfree(s) rfcomm_unlock() walk s->dlcs
The callback can then read a freed session list head and touch freed DLCs while updating their flags or timers.
Serialize the session lookup and DLC traversal in rfcomm_security_cfm() with rfcomm_mutex. This matches the existing RFCOMM session lifetime rules and prevents concurrent rfcomm_session_del() / rfcomm_dlc_unlink() from tearing the objects down while the callback is using them.
KASAN reported:
BUG: KASAN: slab-use-after-free in rfcomm_security_cfm+0x41c/0x440 Read of size 8 at addr ffff888111fb3960 by task kworker/u17:1/89 Workqueue: hci0 hci_rx_work Call Trace: rfcomm_security_cfm+0x41c/0x440 hci_encrypt_cfm+0x139/0x590 hci_encrypt_change_evt+0x37b/0xc40 hci_event_packet+0x71b/0xb20 hci_rx_work+0x293/0x730 Allocated by task 69: rfcomm_session_add+0x9e/0x2f0 rfcomm_run+0x44b/0x41e0 Freed by task 69: kfree+0x131/0x3c0 rfcomm_session_del+0x188/0x220 rfcomm_run+0x1985/0x41e0
AnalysisAI
Use-after-free in the Linux kernel Bluetooth RFCOMM subsystem allows an adjacent Bluetooth peer to trigger kernel memory corruption via a race condition in rfcomm_security_cfm(). The function looks up a session and iterates its DLC list without holding rfcomm_mutex, so a concurrent krfcommd teardown (which does hold the mutex) can free the session and its DLCs while hci_rx_work is still traversing them. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) Bluetooth hardware present and enabled on the target system; (2) the rfcomm kernel module loaded and an RFCOMM (Bluetooth serial-port-profile) session actively established or being torn down; (3) the attacker must be in Bluetooth radio range (AV:A - not remotely exploitable over the internet); (4) the race window between hci_rx_work and krfcommd must be won, requiring either repeated attempts or specific system load conditions (AC:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) overstates exploitability on the AC metric. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify Linux systems with Bluetooth capabilities and assess whether they face Bluetooth exposure from untrusted sources (customer-facing devices, guest networks, shared offices). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today