Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report
Check your stack
CVE-2026-98739

Bluetooth: RFCOMM: Fix initial port reference race

Products / packages Linux

Published

Share

Severity and exploitation

Not in CISA KEVNo CVSS score

KEV coverage does not rule out exploitation.

KEV checked 14/11/2026, 21:10:34 UTC

Severity

unknown

CVSS measures technical severity, not the likelihood of an attack.

Known exploitation

Not listed in the checked CISA KEV catalog

Absence from CISA KEV does not rule out attacks.

Public exploit

Not established by this record

Missing evidence does not mean no public exploit exists.

Remediation

Fix status not established

No structured fix or guidance is available here. Check the latest publisher advisory.

What this means

A vulnerability in the Linux kernel's Bluetooth RFCOMM component allows a race condition, potentially leading to a use-after-free error. The issue affects Linux kernel versions starting from 3.15. An attacker with access to the system may exploit this weakness.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Attack conditions

No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.

Review supporting sources →

Affected versions

Check the exact model, release, and any platform requirements against your installation.

Linux · Linux

Linux

8 ranges
Linux version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

80ea73378af46b0023eb2f400d26c2a60248ffaa → before cd247e38b14df48d6b3940c4573a9f7acb10c363

git versions

80ea73378af46b0023eb2f400d26c2a60248ffaa → before d3dd18e85c140df72e0f2b5ee156ebfba04c06cb

git versions

80ea73378af46b0023eb2f400d26c2a60248ffaa → before c50360a019766fafa27318928bfea96dcce8a37d

git versions

80ea73378af46b0023eb2f400d26c2a60248ffaa → before 55d162aa00d1ee33c3e6fa88b71f1e2d6e1441e9

git versions

80ea73378af46b0023eb2f400d26c2a60248ffaa → before a03ccf1ab77380d4c4a3c56552e12de4a83efa21

git versions

80ea73378af46b0023eb2f400d26c2a60248ffaa → before 0a554901bd227537f79220443b2b36d585d62893

git versions

80ea73378af46b0023eb2f400d26c2a60248ffaa → before e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b

git versions

80ea73378af46b0023eb2f400d26c2a60248ffaa → before 2d696c1ed3468dcb62578a3911e687110d463520

git versions

unaffected

unknown

Other versions: unaffected

Linux · Linux

Linux

10 ranges
Linux version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

3.15

unaffected

0 → before 3.15

semver versions

5.10.273 → through 5.10.*

semver versions

5.15.224 → through 5.15.*

semver versions

6.1.191 → through 6.1.*

semver versions

6.6.160 → through 6.6.*

semver versions

6.12.113 → through 6.12.*

semver versions

6.18.56 → through 6.18.*

semver versions

7.2.10 → through 7.2.*

semver versions

7.3 → through *

original_commit_for_fix versions

unknown

Other versions: affected

Automatic dependency matching is unavailable for this record. Use the product evidence and publisher’s instructions to check your installation.

What to do

Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.

No structured fix or remediation guidance is available here. Check the full source description and vendor’s latest advisory for a patch or workaround; do not assume another version is safe.

cve.new guidance unless attributed to a publisher. This page does not inspect your installation.

Public exploit evidence

No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.

Original source description

Read the full publisher description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Fix initial port reference race

For RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and __rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the initial tty_port reference. The release path tests the bit separately from the install path setting it, so both can drop that reference.

The synchronous hangup does not prevent this race: port->tty is not assigned until tty_port_open(), after installation. The following interleaving is possible:

  1. Install and release each obtain a reference with rfcomm_dev_get().
  2. Release observes RFCOMM_TTY_OWNED clear.
  3. Install sets RFCOMM_TTY_OWNED and drops the initial reference.
  4. Release drops the same initial reference again.
  5. TTY cleanup drops its reference and frees the device.
  6. Release performs its final tty_port_put() on the freed port.

KASAN reported:

BUG: KASAN: slab-use-after-free in tty_port_put+0x22/0x190 Write of size 4 at addr ffff8881001d3d5c by task poc/92

Call Trace: tty_port_put+0x22/0x190 rfcomm_dev_ioctl+0x1d4/0x1930 sock_do_ioctl+0x110/0x260 sock_ioctl+0x380/0x590 __x64_sys_ioctl+0x134/0x1c0

Allocated by task 88: rfcomm_dev_ioctl+0x8f6/0x1930 sock_do_ioctl+0x110/0x260 sock_ioctl+0x380/0x590 __x64_sys_ioctl+0x134/0x1c0

Freed by task 65: kfree+0x131/0x3c0 rfcomm_dev_destruct+0x23b/0x2f0 release_one_tty+0xc1/0x370 process_one_work+0x661/0x1090

Use test_and_set_bit() in both paths so that only the caller that changes RFCOMM_TTY_OWNED from clear to set drops the initial reference. Each path keeps its own lookup reference until release or TTY cleanup, preserving the existing callback ordering and error handling.

References

8 sources
git.kernel.org/stable/c/cd247e38b14df48d6b3940c4573a9f7acb10c363
Source referenceLinux
git.kernel.org/stable/c/d3dd18e85c140df72e0f2b5ee156ebfba04c06cb
Source referenceLinux
git.kernel.org/stable/c/c50360a019766fafa27318928bfea96dcce8a37d
Source referenceLinux
git.kernel.org/stable/c/55d162aa00d1ee33c3e6fa88b71f1e2d6e1441e9
Source referenceLinux
git.kernel.org/stable/c/a03ccf1ab77380d4c4a3c56552e12de4a83efa21
Source referenceLinux
git.kernel.org/stable/c/0a554901bd227537f79220443b2b36d585d62893
Source referenceLinux
View 2 more references
git.kernel.org/stable/c/e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b
Source referenceLinux
git.kernel.org/stable/c/2d696c1ed3468dcb62578a3911e687110d463520
Source referenceLinux

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification · not supplied
Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-98739

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

Linux · platform conditions

Any condition may hold

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 3.15

Before: 5.10.273

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 3.15

Before: 5.15.224

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 3.15

Before: 6.1.191

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 3.15

Before: 6.6.160

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 3.15

Before: 6.12.113

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 3.15

Before: 6.18.56

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 3.15

Before: 7.2.10

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 3.15

Before: 7.3

Applicability preview
[
  {
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "3.15",
            "versionEndExcluding": "5.10.273"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "3.15",
            "versionEndExcluding": "5.15.224"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "3.15",
            "versionEndExcluding": "6.1.191"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "3.15",
            "versionEndExcluding": "6.6.160"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "3.15",
            "versionEndExcluding": "6.12.113"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "3.15",
            "versionEndExcluding": "6.18.56"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "3.15",
            "versionEndExcluding": "7.2.10"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "3.15",
            "versionEndExcluding": "7.3"
          }
        ]
      }
    ]
  }
]
Contributing organizations · 1
Linux

Assigning organization

2026-10-30

Timeline

All times UTC

  1. Advisory published

    Publication date supplied by the source.

  2. Source updated

    Latest modification date supplied by the source.

  3. Last imported by cve.new

    Latest catalog import, not the date we first saw this advisory.

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.