{"id":"CVE-2026-80819","revision":"7a21fa0bc13e4c5eb50f6368cad841bb","records":[{"revision":"7a21fa0bc13e4c5eb50f6368cad841bb","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80819","aliases":[],"title":"Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept\n\nrfcomm_sock_recvmsg() completes a deferred setup by calling\nrfcomm_dlc_accept() without holding any RFCOMM lock:\n\n\tif (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {\n\t\trfcomm_dlc_accept(d);\n\t\treturn 0;\n\t}\n\nand rfcomm_dlc_accept() dereferences the session on its first line:\n\n\tstruct sock *sk = d->session->sock->sk;\n\nEvery other path that touches d->session runs under rfcomm_mutex:\nrfcomm_dlc_open(), rfcomm_dlc_close(), rfcomm_dlc_exists(),\nrfcomm_dlc_send_rpn(), and the RFCOMM thread through\nrfcomm_process_sessions(). rfcomm_connect_ind() is even documented as\n\"called under rfcomm_lock()\". This call site is the only one that skips\nit.\n\nThe RFCOMM_DEFER_SETUP bit looks like it serialises the accept against\nteardown, since __rfcomm_dlc_close() returns early when it wins the\ntest_and_clear. But rfcomm_recv_disc() forces the state first:\n\n\td->state = BT_CLOSED;\n\t__rfcomm_dlc_close(d, err);\n\nand the early return only covers BT_CONNECT, BT_CONFIG, BT_OPEN and\nBT_CONNECT2. With the state already BT_CLOSED that switch does not\nmatch, the bit is never consulted, and __rfcomm_dlc_close() falls\nthrough to rfcomm_dlc_unlink(), which sets d->session = NULL.\n\nSo a remote DISC on a deferred dlc clears the session while leaving\nRFCOMM_DEFER_SETUP set. The next recvmsg() then passes the\ntest_and_clear and dereferences a NULL session. No timing window is\nneeded: once the DISC has been processed, the dereference is\nunconditional.\n\nGive rfcomm_dlc_accept() the same shape as rfcomm_dlc_open() and\nrfcomm_dlc_close(): an exported wrapper that takes rfcomm_mutex and\nre-checks the session, around a __rfcomm_dlc_accept() that the two\nin-core callers, which already hold the mutex, keep using.\n\nReproduced on a KASAN + PROVE_LOCKING kernel with a BR/EDR peer emulated\nover /dev/vhci: the peer brings up an ACL link, opens L2CAP on the\nRFCOMM PSM, starts a session, opens a dlc on a channel bound with\nBT_DEFER_SETUP, and sends DISC after the socket is accepted. recv() on\nthe accepted socket then hits:\n\n Oops: general protection fault\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n RIP: 0010:rfcomm_dlc_accept+0x54/0x350\n Call Trace:\n rfcomm_sock_recvmsg+0x1cd/0x230\n sock_recvmsg+0x166/0x1c0\n __sys_recvfrom+0x20d/0x300\n\n0x10 is the offset of sock in struct rfcomm_session. With this patch the\nsame run completes with recv() returning 0 and no report, and lockdep\nstays quiet, confirming rfcomm_mutex is still taken before lock_sock on\nthis path as it is on the thread side.","state":0,"publishedAt":"2026-09-04T15:13:40.309+00:00","modifiedAt":"2026-10-19T08:44:12.945+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/bluetooth/rfcomm/core.c\"\n ],\n \"versions\": [\n {\n \"version\": \"bb23c0ab824653be4aa7dfca15b07b3059717004\",\n \"lessThan\": \"d8d686dd5662a7c4745e4515f1237a9f3b7df181\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"bb23c0ab824653be4aa7dfca15b07b3059717004\",\n \"lessThan\": \"eb71d5a1ea8ff2683e394b48ae3cd676037ab4c2\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"bb23c0ab824653be4aa7dfca15b07b3059717004\",\n \"lessThan\": \"56f0aa75c7640e46397ef73bea251fcbef9150c0\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"bb23c0ab824653be4aa7dfca15b07b3059717004\",\n \"lessThan\": \"362726c9c6e56eea4262109183e49868c39ccd3a\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"bb23c0ab824653be4aa7dfca15b07b3059717004\",\n \"lessThan\": \"825b95561d7b7c393df9e7bc295451aaeadc3d18\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"bb23c0ab824653be4aa7dfca15b07b3059717004\",\n \"lessThan\": \"d4b1a13b1eff2e80925c7368ffdeaaa50cba93df\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"bb23c0ab824653be4aa7dfca15b07b3059717004\",\n \"lessThan\": \"355bfd57ca4ca881c6eb03ca813b440a094b1f44\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"bb23c0ab824653be4aa7dfca15b07b3059717004\",\n \"lessThan\": \"b405c2f96ae2e37375105881890f7738833b1d62\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"bb23c0ab824653be4aa7dfca15b07b3059717004\",\n \"lessThan\": \"43a556b2fd43f2df6dded59c2e26560a27874c24\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/bluetooth/rfcomm/core.c\"\n ],\n \"versions\": [\n {\n \"version\": \"2.6.30\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"2.6.30\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.267\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.218\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.185\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.154\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.106\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.47\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.1.11\",\n \"lessThanOrEqual\": \"7.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.2.1\",\n \"lessThanOrEqual\": \"7.2.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.3\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/d8d686dd5662a7c4745e4515f1237a9f3b7df181","https://git.kernel.org/stable/c/eb71d5a1ea8ff2683e394b48ae3cd676037ab4c2","https://git.kernel.org/stable/c/56f0aa75c7640e46397ef73bea251fcbef9150c0","https://git.kernel.org/stable/c/362726c9c6e56eea4262109183e49868c39ccd3a","https://git.kernel.org/stable/c/825b95561d7b7c393df9e7bc295451aaeadc3d18","https://git.kernel.org/stable/c/d4b1a13b1eff2e80925c7368ffdeaaa50cba93df","https://git.kernel.org/stable/c/355bfd57ca4ca881c6eb03ca813b440a094b1f44","https://git.kernel.org/stable/c/b405c2f96ae2e37375105881890f7738833b1d62","https://git.kernel.org/stable/c/43a556b2fd43f2df6dded59c2e26560a27874c24"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80819","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80819","identifiers":["CVE-2026-80819"]},"retained":false,"historicalAffected":[]}],"coverage":[]}