{"id":"CVE-2026-98455","kind":"vulnerability","aliases":["CVE-2026-98455"],"related":[],"title":"Linux kernel: RFCOMM getsockopt crashes on a socket after remote disconnect","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO\n\nThe RFCOMM_CONNINFO getsockopt handler accepts a socket that is not\nconnected as long as deferred setup is enabled:\n\n\tif (sk->sk_state != BT_CONNECTED &&\n\t\t\t\t!rfcomm_pi(sk)->dlc->defer_setup) {\n\t\terr = -ENOTCONN;\n\t\tbreak;\n\t}\n\tl2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;\n\ndlc->defer_setup is set in rfcomm_sock_init() when rfcomm_connect_ind()\ncreates a child socket for an incoming connection on a listening socket\nthat has BT_DEFER_SETUP enabled. It is never cleared afterwards. The\nsession, however, can go away underneath it.\n\nrfcomm_recv_disc() forces the dlc state before tearing it down:\n\n\td->state = BT_CLOSED;\n\t__rfcomm_dlc_close(d, err);\n\nThe RFCOMM_DEFER_SETUP early return in __rfcomm_dlc_close() only covers\nBT_CONNECT, BT_CONFIG, BT_OPEN and BT_CONNECT2, so with the state\nalready BT_CLOSED that switch does not match and the function falls\nthrough to rfcomm_dlc_unlink(), which sets d->session = NULL, while\nd->defer_setup stays 1.\n\nA getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted socket after\nthat point therefore skips the -ENOTCONN path -- sk->sk_state is\nBT_CLOSED, but dlc->defer_setup is still set -- and dereferences the\nNULL session. No race is needed: once the DISC has been processed, the\ndereference is unconditional.\n\nReproduced on a KASAN kernel under QEMU with a BR/EDR peer emulated over\n/dev/vhci: the peer brings up an ACL link, opens L2CAP on the RFCOMM\nPSM, starts a session and sends SABM for a channel bound with\nBT_DEFER_SETUP, and sends DISC for that dlci after the socket has been\naccepted. getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted\nsocket then hits:\n\n Oops: general protection fault, probably for non-canonical address\n 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n CPU: 1 UID: 0 PID: 150 Comm: init Tainted: G B 7.3.0-rc3-g5dd1818b15d9\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n RIP: 0010:rfcomm_sock_getsockopt+0x529/0x780\n Call Trace:\n  <TASK>\n  do_sock_getsockopt+0x3ad/0x7d0\n  __sys_getsockopt+0x10e/0x1b0\n  __x64_sys_getsockopt+0xc2/0x160\n  do_syscall_64+0xda/0x4b0\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  </TASK>\n\n0x10 is the offset of sock in struct rfcomm_session;\nrfcomm_sock_getsockopt_old() is inlined into rfcomm_sock_getsockopt().\n\nCommit 43a556b2fd43 (\"Bluetooth: RFCOMM: take rfcomm_mutex for the\ndeferred setup accept\") fixed the same \"a remote DISC clears the session\nwhile deferred setup is still flagged\" problem in rfcomm_dlc_accept();\nthis is the remaining instance of it, in the getsockopt path.\n\nDeferred setup only leaves a socket usable here once it has reached\nBT_CONNECT2, so restrict the exception to that state and check that a\nsession is actually present before following it.","summary":"After a remote DISC on an RFCOMM Bluetooth socket that was accepted with deferred setup, a getsockopt call on RFCOMM_CONNINFO dereferences a NULL session pointer, which crashes the kernel. The sources describe a kernel NULL pointer dereference; the impact beyond denial of service is not stated.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","kernel","linux","other","rfcomm"],"not_affected_if":["no-bluetooth","rfcomm-unused"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream fix from commit `43a556b2fd43` or the mainline change that restricts the RFCOMM_CONNINFO deferred-setup exception to BT_CONNECT2 and checks for a session.\n- Check your distribution's kernel advisory for the fixed package version: unknown","status":"open","published_at":"2026-10-18T16:16:55+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:27:20+00:00","updated_at":"2026-10-25T05:27:20+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T05:27:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream fix from commit `43a556b2fd43` or the mainline change that restricts the RFCOMM_CONNINFO deferred-setup exception to BT_CONNECT2 and checks for a session.\n- Check your distribution's kernel advisory for the fixed package version: unknown","reach":"network","title":"Linux kernel: RFCOMM getsockopt crashes on a socket after remote disconnect","impact":"low","summary":"After a remote DISC on an RFCOMM Bluetooth socket that was accepted with deferred setup, a getsockopt call on RFCOMM_CONNINFO dereferences a NULL session pointer, which crashes the kernel. The sources describe a kernel NULL pointer dereference; the impact beyond denial of service is not stated.","category":"other","nicknames":[],"who_cares":["linux","kernel","bluetooth","rfcomm"],"confidence":0.6,"needs_auth":"unknown","worst_case":"kernel crash from a NULL pointer dereference","analyst_note":"Check NVD and the kernel stable git tree for the affected version range, fixed versions, and whether the remote peer needs pairing or ACL access before the DISC can be sent.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-bluetooth","rfcomm-unused"],"who_is_affected":"Systems running a Linux kernel with Bluetooth RFCOMM enabled that use listening sockets with BT_DEFER_SETUP. Systems without Bluetooth or RFCOMM in use are unlikely to be exposed. The sources do not state the exact affected kernel version range.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000772,"input_tokens":4623,"output_tokens":620,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':419C,426C,430C,435C,440C,447C '-2026':13A,16A '-98455':14A,17A '/dev/vhci':314C '0':394C '0000':376C '0010':415C '0x0000000000000010':389C '0x0000000000000010-0x0000000000000017':388C '0x0000000000000017':390C '0x10':449C '0xdffffc0000000002':375C '1':250C,377C,392C '150':396C '1996':413C '43a556b2fd43':470C '64':439C,444C '7.3.0':402C 'accept':34B,96C,259C,353C,361C,480C,500C 'acl':320C 'actual':539C 'address':374C 'afterward':169C 'alreadi':223C 'away':175C 'b':401C 'beyond':63B 'bluetooth':18B,30B,80C,471C 'bound':337C 'br/edr':310C 'break':124C 'bring':317C 'bt':114C,161C,191C,210C,212C,214C,217C,224C,273C,339C,524C 'call':40B,421C 'canon':373C 'channel':336C 'check':534C 'child':149C 'clear':168C,487C 'close':192C,195C,207C,225C,274C 'comm':397C 'commit':469C 'config':213C 'connect':102C,115C,145C,154C,211C 'connect2':218C,525C 'conninfo':43B,90C,93C,256C,358C 'cover':209C 'cpu':391C 'crash':5A,50B 'creat':147C 'cve':12A,15A 'd':189C,196C,242C,246C 'defer':36B,106C,120C,135C,162C,200C,247C,277C,340C,478C,491C,512C 'denial':64B 'deref':385C 'derefer':44B,60B,84C,283C,298C 'describ':55B 'disc':26B,180C,293C,344C,486C 'disconnect':11A 'dlc':86C,119C,130C,134C,183C,194C,206C,238C,276C,499C 'dlci':347C 'earli':202C 'emul':312C 'enabl':109C,164C 'enotconn':123C,267C 'entri':442C 'err':122C,197C 'except':529C 'fall':234C 'fault':368C 'fix':82C,481C 'flag':495C 'follow':75C,542C 'forc':181C 'function':233C 'g':400C 'g5dd1818b15d9':405C 'general':366C 'getsockopt':4A,39B,94C,252C,354C,418C,425C,429C,434C,461C,468C,510C 'go':174C 'handler':95C 'hardwar':406C 'hit':364C 'howev':172C 'hwframe':446C 'i440fx':411C 'impact':62B 'incom':153C 'ind':146C 'init':142C,398C 'inlin':464C 'instanc':505C 'kasan':304C,379C,381C 'kernel':2A,19B,52B,57B,73C,305C 'l2cap':125C,323C 'leav':515C 'link':321C 'linux':1A,20B,72C 'listen':157C 'long':104C 'match':230C 'mutex':475C 'name':407C 'need':290C 'never':167C 'non':372C 'non-canon':371C 'null':46B,58B,83C,244C,285C,383C 'null-ptr-deref':382C 'offset':452C 'old':462C 'oop':365C 'open':215C,322C 'path':268C,511C 'pc':410C 'peer':311C,316C 'pi':117C,128C 'pid':395C 'piix':412C 'point':263C 'pointer':48B,59B 'present':540C 'probabl':369C 'problem':496C 'process':296C 'protect':367C 'psm':327C 'pti':380C 'ptr':384C 'qemu':307C,408C 'race':288C 'rang':387C 'rc3':404C 'rc3-g5dd1818b15d9':403C 'reach':523C 'recv':179C 'remain':504C 'remot':10A,25B,485C 'reproduc':301C 'resolv':79C 'restrict':527C 'return':203C 'rfcomm':3A,22B,29B,42B,81C,89C,92C,116C,127C,140C,144C,178C,193C,199C,205C,237C,254C,255C,326C,356C,357C,416C,457C,459C,466C,472C,474C,498C 'rip':414C 'sabm':333C 'send':332C,343C 'servic':66B 'session':47B,87C,131C,171C,243C,286C,330C,458C,489C,537C 'set':138C,241C,281C 'setup':37B,107C,121C,136C,163C,201C,248C,278C,341C,479C,492C,513C 'sk':111C,112C,118C,126C,129C,133C,269C,270C 'skip':265C 'smp':378C 'sock':132C,141C,417C,424C,454C,460C,467C 'socket':8A,31B,98C,150C,158C,260C,350C,362C,517C 'sol':253C,355C 'sourc':54B 'standard':409C 'start':328C 'state':69B,113C,184C,190C,222C,271C,532C 'stay':249C 'still':280C,494C 'struct':456C 'switch':227C 'sys':428C,433C 'syscal':438C,443C 'taint':399C 'take':473C 'tear':186C 'therefor':264C 'trace':422C 'uid':393C 'uncondit':300C 'underneath':176C 'unlink':239C 'usabl':518C 'vulner':76C 'x10e/0x1b0':431C 'x3ad/0x7d0':427C 'x529/0x780':420C 'x64':432C 'x77/0x7f':448C 'xc2/0x160':436C 'xda/0x4b0':441C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with Bluetooth RFCOMM enabled that use listening sockets with BT_DEFER_SETUP. Systems without Bluetooth or RFCOMM in use are unlikely to be exposed. The sources do not state the exact affected kernel version range.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98455","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98455","severity":null,"published_at":"2026-10-18T16:16:55+00:00","modified_at":"2026-10-19T10:18:54+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}