CVE-2026-98455: Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

CVE-2026-98455: Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

The RFCOMM_CONNINFO getsockopt handler accepts a socket that is not
connected as long as deferred setup is enabled:

	if (sk->sk_state != BT_CONNECTED &&
				!rfcomm_pi(sk)->dlc->defer_setup) {
		err = -ENOTCONN;
		break;
	}
	l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;

dlc->defer_setup is set in rfcomm_sock_init() when rfcomm_connect_ind()
creates a child socket for an incoming connection on a listening socket
that has BT_DEFER_SETUP enabled. It is never cleared afterwards. The
session, however, can go away underneath it.

rfcomm_recv_disc() forces the dlc state before tearing it down:

	d->state = BT_CLOSED;
	__rfcomm_dlc_close(d, err);

The RFCOMM_DEFER_SETUP early return in __rfcomm_dlc_close() only covers
BT_CONNECT, BT_CONFIG, BT_OPEN and BT_CONNECT2, so with the state
already BT_CLOSED that switch does not match and the function falls
through to rfcomm_dlc_unlink(), which sets d->session = NULL, while
d->defer_setup stays 1.

A getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted socket after
that point therefore skips the -ENOTCONN path -- sk->sk_state is
BT_CLOSED, but dlc->defer_setup is still set -- and dereferences the
NULL session. No race is needed: once the DISC has been processed, the
dereference is unconditional.

Reproduced on a KASAN kernel under QEMU with a BR/EDR peer emulated over
/dev/vhci: the peer brings up an ACL link, opens L2CAP on the RFCOMM
PSM, starts a session and sends SABM for a channel bound with
BT_DEFER_SETUP, and sends DISC for that dlci after the socket has been
accepted. getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted
socket then hits:

 Oops: general protection fault, probably for non-canonical address
 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI
 KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
 CPU: 1 UID: 0 PID: 150 Comm: init Tainted: G B 7.3.0-rc3-g5dd1818b15d9
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
 RIP: 0010:rfcomm_sock_getsockopt+0x529/0x780
 Call Trace:
  <TASK>
  do_sock_getsockopt+0x3ad/0x7d0
  __sys_getsockopt+0x10e/0x1b0
  __x64_sys_getsockopt+0xc2/0x160
  do_syscall_64+0xda/0x4b0
  entry_SYSCALL_64_after_hwframe+0x77/0x7f
  </TASK>

0x10 is the offset of sock in struct rfcomm_session;
rfcomm_sock_getsockopt_old() is inlined into rfcomm_sock_getsockopt().

Commit 43a556b2fd43 ("Bluetooth: RFCOMM: take rfcomm_mutex for the
deferred setup accept") fixed the same "a remote DISC clears the session
while deferred setup is still flagged" problem in rfcomm_dlc_accept();
this is the remaining instance of it, in the getsockopt path.

Deferred setup only leaves a socket usable here once it has reached
BT_CONNECT2, so restrict the exception to that state and check that a
session is actually present before following it.

The Linux kernel CVE team has assigned CVE-2026-98455 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.30 with commit bb23c0ab824653be4aa7dfca15b07b3059717004 and fixed in 5.10.271 with commit c3aee3fc1287c8a555baf3895959087cb0c33fe8
	Issue introduced in 2.6.30 with commit bb23c0ab824653be4aa7dfca15b07b3059717004 and fixed in 5.15.222 with commit 4bf5ca47203049ce3648f750a53dcdc98bcc9e3e
	Issue introduced in 2.6.30 with commit bb23c0ab824653be4aa7dfca15b07b3059717004 and fixed in 6.1.189 with commit 1c4f7e1177da2f229be04139c27e5370a1cfba52
	Issue introduced in 2.6.30 with commit bb23c0ab824653be4aa7dfca15b07b3059717004 and fixed in 6.6.158 with commit 84ae3cfd7d3a63591a2eb4faa24faf678c6708aa
	Issue introduced in 2.6.30 with commit bb23c0ab824653be4aa7dfca15b07b3059717004 and fixed in 6.12.112 with commit c7362f6a18ed167f52f08ce25eeec8a7818c5004
	Issue introduced in 2.6.30 with commit bb23c0ab824653be4aa7dfca15b07b3059717004 and fixed in 6.18.55 with commit 8f5b30cc12c409ff62891e47ed51e6bf0945a3ea
	Issue introduced in 2.6.30 with commit bb23c0ab824653be4aa7dfca15b07b3059717004 and fixed in 7.2.9 with commit 005b23d9e324fe5d0acbcfa70c625f2e81189046
	Issue introduced in 2.6.30 with commit bb23c0ab824653be4aa7dfca15b07b3059717004 and fixed in 7.3-rc5 with commit 46f8ffd0a1f1eb6cbc94946a92c11ef601e228a1

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-98455
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bluetooth/rfcomm/sock.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c3aee3fc1287c8a555baf3895959087cb0c33fe8
	https://git.kernel.org/stable/c/4bf5ca47203049ce3648f750a53dcdc98bcc9e3e
	https://git.kernel.org/stable/c/1c4f7e1177da2f229be04139c27e5370a1cfba52
	https://git.kernel.org/stable/c/84ae3cfd7d3a63591a2eb4faa24faf678c6708aa
	https://git.kernel.org/stable/c/c7362f6a18ed167f52f08ce25eeec8a7818c5004
	https://git.kernel.org/stable/c/8f5b30cc12c409ff62891e47ed51e6bf0945a3ea
	https://git.kernel.org/stable/c/005b23d9e324fe5d0acbcfa70c625f2e81189046
	https://git.kernel.org/stable/c/46f8ffd0a1f1eb6cbc94946a92c11ef601e228a1