Cloudanix VulnDB

CVE-2026-89569

High · 8.8

CVSS

8.8

EPSS

0.3%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in how Linux handles certain Bluetooth connections could let an attacker near the device crash the system or potentially run code by interfering with internal memory cleanup.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in rfcomm_security_cfm() that performs session lookup and DLC list traversal without rfcomm_mutex, allowing krfcommd to concurrently free the session and DLC objects via rfcomm_session_del() and rfcomm_dlc_unlink() during hci_rx_work processing.

Why it matters to the business

Kernel memory corruption or crash on Bluetooth-enabled Linux systems can lead to denial of service or potential privilege escalation affecting wireless connectivity and device stability.

How an attack unfolds

An attacker sends crafted Bluetooth RFCOMM security confirmation events that trigger rfcomm_security_cfm() while a concurrent session teardown frees the underlying structures, resulting in reads from freed slab memory.

How to fix it

Apply the upstream kernel patch that acquires rfcomm_mutex around the session lookup and DLC traversal in rfcomm_security_cfm(); rebuild and deploy updated kernels on affected systems.

How to confirm the fix worked

Verify the presence of the mutex acquisition in rfcomm_security_cfm() source, confirm no KASAN slab-use-after-free reports on rfcomm paths after patching, and test Bluetooth RFCOMM connections under load.

Typical attack path

  1. Establish RFCOMM session over Bluetooth
  2. Trigger concurrent security confirmation callback via hci_rx_work
  3. Force session teardown in krfcommd under rfcomm_mutex
  4. Access freed session list head and DLC objects in the callback
  5. Read or write freed memory leading to crash or corruption

How to detect it

Search kernel logs and crash dumps for KASAN slab-use-after-free messages referencing rfcomm_security_cfm, hci_rx_work, or rfcomm_session_del; inspect Bluetooth-related workqueues and mutex contention around session teardown.

  • BUG: KASAN: slab-use-after-free in rfcomm_security_cfm
  • rfcomm_security_cfm+0x41c/0x440
  • Workqueue: hci0 hci_rx_work
  • Freed by task.*rfcomm_session_del

What your security team should do

  • Prioritize kernel updates for Bluetooth-enabled systems within standard patch windows given low EPSS
  • Monitor kernel logs for KASAN or use-after-free reports involving rfcomm_security_cfm
  • Limit RFCOMM usage to trusted peers until patched
  • Include Bluetooth stack in regular kernel vulnerability scanning

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcomm_security_cfm() looks up a session on session_list and then walks its DLC list without holding rfcomm_mutex. Since RFCOMM session teardown uses rfcomm_mutex, krfcommd can close and free the same session and DLCs concurrently: hci_rx_work krfcommd ----------- --------- rfcomm_session_get() rfcomm_lock() rfcomm_session_close() rfcomm_dlc_unlink() rfcomm_session_del() kfree(s) rfcomm_unlock() walk s->dlcs The callback can then read a freed session list head and touch freed DLCs while updating their flags or timers. Serialize the session lookup and DLC traversal in rfcomm_security_cfm() with rfcomm_mutex. This matches the existing RFCOMM session lifetime rules and prevents concurrent rfcomm_session_del() / rfcomm_dlc_unlink() from tearing the objects down while the callback is using them. KASAN reported: BUG: KASAN: slab-use-after-free in rfcomm_security_cfm+0x41c/0x440 Read of size 8 at addr ffff888111fb3960 by task kworker/u17:1/89 Workqueue: hci0 hci_rx_work Call Trace: rfcomm_security_cfm+0x41c/0x440 hci_encrypt_cfm+0x139/0x590 hci_encrypt_change_evt+0x37b/0xc40 hci_event_packet+0x71b/0xb20 hci_rx_work+0x293/0x730 Allocated by task 69: rfcomm_session_add+0x9e/0x2f0 rfcomm_run+0x44b/0x41e0 Freed by task 69: kfree+0x131/0x3c0 rfcomm_session_del+0x188/0x220 rfcomm_run+0x1985/0x41e0

Affected packages

Ecosystem Package Introduced Fixed