All vulnerabilities
CVE-2026-98290

Linux: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4aafb47301a799d3e01230d6568c4e93524e1523Also 18174b166547ef41973cc19feb5ef9cab39a8def, 801fb950cae7048eb7d83b18857d1ca37b8cd5a4CVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 4aafb47301a799d3e01230d6568c4e93524e1523LinuxCVE List
  • 18174b166547ef41973cc19feb5ef9cab39a8defLinuxCVE List
  • 801fb950cae7048eb7d83b18857d1ca37b8cd5a4LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup

rfcomm_sock_cleanup_listen() closes unaccepted child sockets through rfcomm_sock_close(), which takes the child socket lock before rfcomm_dlc_close() acquires rfcomm_mutex. The RFCOMM worker takes these locks in reverse order while handling connections and DLC state changes, so lockdep reports a possible deadlock.

Close dequeued children without taking their socket lock. The accept queue owns a reference to each child, and bt_accept_dequeue() locks the child while unlinking it and clearing its parent pointer.

Dropping the child lock makes it important to prevent a concurrent rfcomm_connect_ind() from enqueueing a new child after cleanup observes an empty queue. Set a listening socket to BT_CLOSED while its lock is still held, before dropping the lock and draining the queue. The state check in rfcomm_connect_ind() then rejects new children once cleanup starts.

Text from CVE List

Affected versions 16

  • Linuxaffected: b7ce436a5d798bc59e71797952566608a4b4626b before eb4adaa46e4c9e6efa7be3ce06398f4d7c39b57cCVE List
  • Linuxaffected: b7ce436a5d798bc59e71797952566608a4b4626b before 4aafb47301a799d3e01230d6568c4e93524e1523CVE List
  • Linuxaffected: b7ce436a5d798bc59e71797952566608a4b4626b before c741977e413f5b49d306700820fb55ccb8269f5aCVE List
  • Linuxaffected: b7ce436a5d798bc59e71797952566608a4b4626b before c6792c441767256030606eb82dca5d5fc360dd9aCVE List
  • Linuxaffected: b7ce436a5d798bc59e71797952566608a4b4626b before bfce253f039eb5f58b810af267942a9f59207254CVE List
  • Linuxaffected: b7ce436a5d798bc59e71797952566608a4b4626b before 18174b166547ef41973cc19feb5ef9cab39a8defCVE List
  • Linuxaffected: b7ce436a5d798bc59e71797952566608a4b4626b before 801fb950cae7048eb7d83b18857d1ca37b8cd5a4CVE List
  • Linuxaffected: 5.15CVE List
  • Linuxunaffected: all versions before 5.15CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7