From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8C42A374A08 for ; Sun, 18 Oct 2026 15:18:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792336697; cv=none; b=EPNIdgma8L3GO1JebYqMt6Ky7Bp0sldbVrKF5hgUz7/e+SsCpoQKzoY5QJTXsYABGUwmZWijGQs1IzkM1N48K9zVAg6dihMw1VJrPK8QfOWidRczizQF3QI8o1l/V7zfna/YQtq2oXIMOvgyd5bmvNX7vmqVA7mg1uVDdwAXttc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792336697; c=relaxed/simple; bh=LZ7Piho4bmkI5onFZRhL1YsCSgThz/OofIqoEuGzau4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=PjEDt8hiDxLGaoAqt/3o9Xnf0Kz5JyoSPFpS1ofXwldylZf5IFtcjKh2BrOaIDSYHvPk1QEIf303EwZfJf6OqNyoQp6doblh+KmVk0cXjRCudh71kR5FC+6hIDyJdobECK6RerYD1I+zA8V2aIi9HO2hWOJh9MPl7/fuo2dAtgs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vgZ5c76d; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="vgZ5c76d" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C98921F000C5; Sun, 18 Oct 2026 15:18:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792336696; bh=Jnb3H4gp0NvFpvkb8MFKrryzXxrRaVwTyc/4rVJ5MPo=; h=From:To:Cc:Subject:Date:Reply-To; b=vgZ5c76dBtzBtojYrqCmC0An/H7/Pu01yTPlIRIBKHDE0femqZj5oBEs8qyy4islF h5pg9QGEi8iRfCROT24MpKms4736a/3gAWUdSJNEWNxFtH1Kzrhn7Ry2UoUoeo7sQz Sw4k71+2B4MQLzFD123Y6ooWPV3pK0vRoCH83Iys= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98455: Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO Date: Sun, 18 Oct 2026 17:15:19 +0200 Message-ID: <2026101809-CVE-2026-98455-c201@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=6008; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=txIm/60VHwIfQcfA3xyo9npvYa0jAUIr4xx/hngnz+s=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlXHtUeCOo+V95V2Fi9sbH1kuyGCSzPuY0neP+5varfJ HKvxxW/jlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZgI/36G+ek189OXXH74TffU n5DVhjX7hRqsDjHMZnFv1lVzubQn4o/1K7atdqx/Z//ZBAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO The RFCOMM_CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if (sk->sk_state != BT_CONNECTED && !rfcomm_pi(sk)->dlc->defer_setup) { err = -ENOTCONN; break; } l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk; dlc->defer_setup is set in rfcomm_sock_init() when rfcomm_connect_ind() creates a child socket for an incoming connection on a listening socket that has BT_DEFER_SETUP enabled. It is never cleared afterwards. The session, however, can go away underneath it. rfcomm_recv_disc() forces the dlc state before tearing it down: d->state = BT_CLOSED; __rfcomm_dlc_close(d, err); The RFCOMM_DEFER_SETUP early return in __rfcomm_dlc_close() only covers BT_CONNECT, BT_CONFIG, BT_OPEN and BT_CONNECT2, so with the state already BT_CLOSED that switch does not match and the function falls through to rfcomm_dlc_unlink(), which sets d->session = NULL, while d->defer_setup stays 1. A getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted socket after that point therefore skips the -ENOTCONN path -- sk->sk_state is BT_CLOSED, but dlc->defer_setup is still set -- and dereferences the NULL session. No race is needed: once the DISC has been processed, the dereference is unconditional. Reproduced on a KASAN kernel under QEMU with a BR/EDR peer emulated over /dev/vhci: the peer brings up an ACL link, opens L2CAP on the RFCOMM PSM, starts a session and sends SABM for a channel bound with BT_DEFER_SETUP, and sends DISC for that dlci after the socket has been accepted. getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted socket then hits: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 1 UID: 0 PID: 150 Comm: init Tainted: G B 7.3.0-rc3-g5dd1818b15d9 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:rfcomm_sock_getsockopt+0x529/0x780 Call Trace: do_sock_getsockopt+0x3ad/0x7d0 __sys_getsockopt+0x10e/0x1b0 __x64_sys_getsockopt+0xc2/0x160 do_syscall_64+0xda/0x4b0 entry_SYSCALL_64_after_hwframe+0x77/0x7f 0x10 is the offset of sock in struct rfcomm_session; rfcomm_sock_getsockopt_old() is inlined into rfcomm_sock_getsockopt(). Commit 43a556b2fd43 ("Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept") fixed the same "a remote DISC clears the session while deferred setup is still flagged" problem in rfcomm_dlc_accept(); this is the remaining instance of it, in the getsockopt path. Deferred setup only leaves a socket usable here once it has reached BT_CONNECT2, so restrict the exception to that state and check that a session is actually present before following it. The Linux kernel CVE team has assigned CVE-2026-98455 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.30 with commit bb23c0ab824653be4aa7dfca15b07b3059717004 and fixed in 5.10.271 with commit c3aee3fc1287c8a555baf3895959087cb0c33fe8 Issue introduced in 2.6.30 with commit bb23c0ab824653be4aa7dfca15b07b3059717004 and fixed in 5.15.222 with commit 4bf5ca47203049ce3648f750a53dcdc98bcc9e3e Issue introduced in 2.6.30 with commit bb23c0ab824653be4aa7dfca15b07b3059717004 and fixed in 6.1.189 with commit 1c4f7e1177da2f229be04139c27e5370a1cfba52 Issue introduced in 2.6.30 with commit bb23c0ab824653be4aa7dfca15b07b3059717004 and fixed in 6.6.158 with commit 84ae3cfd7d3a63591a2eb4faa24faf678c6708aa Issue introduced in 2.6.30 with commit bb23c0ab824653be4aa7dfca15b07b3059717004 and fixed in 6.12.112 with commit c7362f6a18ed167f52f08ce25eeec8a7818c5004 Issue introduced in 2.6.30 with commit bb23c0ab824653be4aa7dfca15b07b3059717004 and fixed in 6.18.55 with commit 8f5b30cc12c409ff62891e47ed51e6bf0945a3ea Issue introduced in 2.6.30 with commit bb23c0ab824653be4aa7dfca15b07b3059717004 and fixed in 7.2.9 with commit 005b23d9e324fe5d0acbcfa70c625f2e81189046 Issue introduced in 2.6.30 with commit bb23c0ab824653be4aa7dfca15b07b3059717004 and fixed in 7.3-rc5 with commit 46f8ffd0a1f1eb6cbc94946a92c11ef601e228a1 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98455 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/bluetooth/rfcomm/sock.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c3aee3fc1287c8a555baf3895959087cb0c33fe8 https://git.kernel.org/stable/c/4bf5ca47203049ce3648f750a53dcdc98bcc9e3e https://git.kernel.org/stable/c/1c4f7e1177da2f229be04139c27e5370a1cfba52 https://git.kernel.org/stable/c/84ae3cfd7d3a63591a2eb4faa24faf678c6708aa https://git.kernel.org/stable/c/c7362f6a18ed167f52f08ce25eeec8a7818c5004 https://git.kernel.org/stable/c/8f5b30cc12c409ff62891e47ed51e6bf0945a3ea https://git.kernel.org/stable/c/005b23d9e324fe5d0acbcfa70c625f2e81189046 https://git.kernel.org/stable/c/46f8ffd0a1f1eb6cbc94946a92c11ef601e228a1