{"id":"CVE-2026-98739","kind":"vulnerability","aliases":["CVE-2026-98739"],"related":[],"title":"Linux kernel Bluetooth RFCOMM: race frees TTY port, use-after-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fix initial port reference race\n\nFor RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and\n__rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the\ninitial tty_port reference. The release path tests the bit separately\nfrom the install path setting it, so both can drop that reference.\n\nThe synchronous hangup does not prevent this race: port->tty is not\nassigned until tty_port_open(), after installation. The following\ninterleaving is possible:\n\n  1. Install and release each obtain a reference with rfcomm_dev_get().\n  2. Release observes RFCOMM_TTY_OWNED clear.\n  3. Install sets RFCOMM_TTY_OWNED and drops the initial reference.\n  4. Release drops the same initial reference again.\n  5. TTY cleanup drops its reference and frees the device.\n  6. Release performs its final tty_port_put() on the freed port.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in tty_port_put+0x22/0x190\n  Write of size 4 at addr ffff8881001d3d5c by task poc/92\n\n  Call Trace:\n   tty_port_put+0x22/0x190\n   rfcomm_dev_ioctl+0x1d4/0x1930\n   sock_do_ioctl+0x110/0x260\n   sock_ioctl+0x380/0x590\n   __x64_sys_ioctl+0x134/0x1c0\n\n  Allocated by task 88:\n   rfcomm_dev_ioctl+0x8f6/0x1930\n   sock_do_ioctl+0x110/0x260\n   sock_ioctl+0x380/0x590\n   __x64_sys_ioctl+0x134/0x1c0\n\n  Freed by task 65:\n   kfree+0x131/0x3c0\n   rfcomm_dev_destruct+0x23b/0x2f0\n   release_one_tty+0xc1/0x370\n   process_one_work+0x661/0x1090\n\nUse test_and_set_bit() in both paths so that only the caller that changes\nRFCOMM_TTY_OWNED from clear to set drops the initial reference. Each path\nkeeps its own lookup reference until release or TTY cleanup, preserving\nthe existing callback ordering and error handling.","summary":"A race in the Linux kernel's Bluetooth RFCOMM code lets two paths both drop the same initial tty_port reference when an RFCOMM_RELEASE_ONHUP device is installed and released concurrently. The result is a use-after-free on the freed port, which KASAN reported as a write from an ioctl.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","linux-kernel","rfcomm","runtime"],"not_affected_if":["bluetooth-disabled"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:27+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:05+00:00","updated_at":"2026-10-25T05:17:05+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:17:05Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel Bluetooth RFCOMM: race frees TTY port, use-after-free","impact":"high","summary":"A race in the Linux kernel's Bluetooth RFCOMM code lets two paths both drop the same initial tty_port reference when an RFCOMM_RELEASE_ONHUP device is installed and released concurrently. The result is a use-after-free on the freed port, which KASAN reported as a write from an ioctl.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","bluetooth","rfcomm"],"confidence":0.5,"needs_auth":"unknown","worst_case":"local user triggers use-after-free in kernel memory","analyst_note":"Find the kernel stable commit and affected/fixed version ranges for CVE-2026-98739 in the NVD entry or kernel.org CVE feed.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["bluetooth-disabled"],"who_is_affected":"Systems running a Linux kernel with Bluetooth RFCOMM support that use RFCOMM TTY devices (RFCOMM_RELEASE_ONHUP) are the ones this race applies to. The sources do not name affected kernel versions or say whether a default build exposes the path.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000651,"input_tokens":4025,"output_tokens":498,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':237C,254C,259C,264C,268C,273C,282C,287C,291C,296C,303C,308C,313C,318C '-2026':14A,17A '-98739':15A,18A '1':164C '2':176C '3':183C '4':194C,242C '5':202C '6':212C '65':301C '88':278C 'addr':244C 'alloc':275C 'assign':152C 'bit':126C,324C 'bluetooth':3A,19B,32B,88C 'bug':226C 'call':249C 'callback':361C 'caller':332C 'chang':334C 'cleanup':204C,357C 'clear':182C,339C 'code':34B 'concurr':56B 'cve':13A,16A 'decid':113C 'destruct':307C 'dev':106C,174C,257C,280C,306C 'devic':51B,99C,211C 'drop':39B,115C,137C,190C,196C,205C,342C 'error':364C 'exist':360C 'ffff8881001d3d5c':245C 'final':216C 'fix':90C 'follow':83C,160C 'free':6A,12A,64B,209C,232C 'freed':67B,222C,298C 'get':175C 'handl':365C 'hangup':142C 'initi':42B,91C,117C,192C,199C,344C 'instal':53B,102C,130C,158C,165C,184C 'interleav':161C 'ioctl':77B,258C,263C,267C,272C,281C,286C,290C,295C 'kasan':70B,224C,227C 'keep':348C 'kernel':2A,22B,30B,81C 'kfree':302C 'let':35B 'linux':1A,21B,29B,80C 'linux-kernel':20B 'lookup':351C 'observ':178C 'obtain':169C 'one':311C,316C 'onhup':50B,98C 'open':156C 'order':362C 'own':111C,181C,188C,337C 'path':37B,123C,131C,327C,347C 'perform':214C 'poc/92':248C 'port':8A,44B,68B,92C,119C,148C,155C,218C,223C,235C,252C 'possibl':163C 'preserv':358C 'prevent':145C 'process':315C 'put':219C,236C,253C 'race':5A,26B,94C,147C 'refer':45B,93C,120C,139C,171C,193C,200C,207C,345C,352C 'releas':49B,55B,97C,105C,122C,167C,177C,195C,213C,310C,354C 'report':71B,225C 'resolv':87C 'result':58B 'rfcomm':4A,23B,33B,48B,89C,96C,100C,104C,109C,173C,179C,186C,256C,279C,305C,335C 'runtim':24B 'separ':127C 'set':132C,185C,323C,341C 'size':241C 'slab':229C 'slab-use-after-fre':228C 'sock':261C,266C,284C,289C 'synchron':141C 'sys':271C,294C 'task':247C,277C,300C 'test':124C,321C 'trace':250C 'tti':7A,43B,101C,110C,118C,149C,154C,180C,187C,203C,217C,234C,251C,312C,336C,356C 'two':36B 'use':10A,62B,108C,230C,320C 'use-after-fre':9A,61B 'vulner':84C 'work':317C 'write':74B,239C 'x110/0x260':265C,288C 'x131/0x3c0':304C 'x134/0x1c0':274C,297C 'x1d4/0x1930':260C 'x22/0x190':238C,255C 'x23b/0x2f0':309C 'x380/0x590':269C,292C 'x64':270C,293C 'x661/0x1090':319C 'x8f6/0x1930':283C 'xc1/0x370':314C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with Bluetooth RFCOMM support that use RFCOMM TTY devices (RFCOMM_RELEASE_ONHUP) are the ones this race applies to. The sources do not name affected kernel versions or say whether a default build exposes the path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98739","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98739","severity":null,"published_at":"2026-10-18T16:17:27+00:00","modified_at":"2026-10-21T13:21:41+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}