EUVD-2026-93218
GHSA-vgg6-jhr8-9c2m
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent Bluetooth reach (AV:A) and a race window (AC:H) with no auth (PR:N); a deadlock yields only a hang, so A:H with C:N/I:N.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
rfcomm_sock_cleanup_listen() closes unaccepted child sockets through rfcomm_sock_close(), which takes the child socket lock before rfcomm_dlc_close() acquires rfcomm_mutex. The RFCOMM worker takes these locks in reverse order while handling connections and DLC state changes, so lockdep reports a possible deadlock.
Close dequeued children without taking their socket lock. The accept queue owns a reference to each child, and bt_accept_dequeue() locks the child while unlinking it and clearing its parent pointer.
Dropping the child lock makes it important to prevent a concurrent rfcomm_connect_ind() from enqueueing a new child after cleanup observes an empty queue. Set a listening socket to BT_CLOSED while its lock is still held, before dropping the lock and draining the queue. The state check in rfcomm_connect_ind() then rejects new children once cleanup starts.
AnalysisAI
A possible kernel deadlock in the Linux kernel's Bluetooth RFCOMM listener teardown path can be reached by an unauthenticated attacker within Bluetooth radio range (AV:A, PR:N per the vector) who races a new incoming RFCOMM connection against the cleanup of a listening socket. Triggering requires Bluetooth to be enabled on the target, a live application listening on an RFCOMM channel, proximity, and a narrow timing window (AC:H); the condition was reported by lockdep as a POSSIBLE lock-order inversion between a child socket lock and rfcomm_mutex, not a confirmed and reliably reproducible crash, and the assessed impact is availability only (C:N/I:N/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target Linux host to have Bluetooth enabled and an application listening on an RFCOMM channel (a listening RFCOMM socket), and the attacker must be within Bluetooth radio range (AV:A). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a concurrency defect (lock-order inversion between a child socket lock and rfcomm_mutex) in the Linux kernel Bluetooth RFCOMM listener cleanup path, reported by lockdep as a POSSIBLE deadlock rather than a confirmed, reliably triggerable one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to the fixed stable versions 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54 or 7.2.8 (the fix is also present in 7.3-rc4), which correspond to the upstream stable commits at https://git.kernel.org/stable/c/eb4adaa46e4c9e6efa7be3ce06398f4d7c39b57c, https://git.kernel.org/stable/c/c741977e413f5b49d306700820fb55ccb8269f5a, https://git.kernel.org/stable/c/bfce253f039eb5f58b810af267942a9f59207254, https://git.kernel.org/stable/c/18174b166547ef41973cc19feb5ef9cab39a8def, https://git.kernel.org/stable/c/801fb950cae7048eb7d83b18857d1ca37b8cd5a4, https://git.kernel.org/stable/c/4aafb47301a799d3e01230d6568c4e93524e1523 and https://git.kernel.org/stable/c/c6792c441767256030606eb82dca5d5fc360dd9a, with advisory context at https://nvd.nist.gov/vuln/detail/CVE-2026-98290. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems with Bluetooth enabled and applications listening on RFCOMM channels, and consider disabling Bluetooth on non-critical systems to reduce exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated Bluetooth Low Energy OTA firmware upgrade in the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware
CVE-2025-32879 is a security vulnerability (CVSS 8.8) that allows an attacker. Risk factors: public PoC available.
Heap OOB write in Android Bluetooth driver via incorrect bounds check.
A use-after-free in the Android Bluetooth stack (bluetooth_ccc.cc, function BluetoothCccHandlerCallbackImpl) lets an att
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may
A memory leak combined with a use-after-free in the Linux kernel's Bluetooth HCI connection-setup path can crash the ker
Memory corruption in the Zephyr RTOS LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) lets an attac
A race condition in the Linux kernel's Bluetooth L2CAP subsystem allows a use-after-free of the hci_conn::l2cap_data poi
Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into usersp
Use-after-free in the Linux kernel Bluetooth L2CAP stack lets a Bluetooth-adjacent attacker corrupt kernel memory by rac
Kernel crashes with a NULL-pointer dereference in the Linux kernel's Bluetooth L2CAP socket layer when l2cap_sock_cleanu
Local users on Linux hosts running the kernel Bluetooth stack (CONFIG_BT) can crash the system by racing an hci_conn tea
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today