CVE-2026-98739

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98739", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.367Z", "datePublished": "2026-10-18T15:47:23.653Z", "dateUpdated": "2026-10-30T12:39:14.099Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:39:14.099Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fix initial port reference race\n\nFor RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and\n__rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the\ninitial tty_port reference. The release path tests the bit separately\nfrom the install path setting it, so both can drop that reference.\n\nThe synchronous hangup does not prevent this race: port->tty is not\nassigned until tty_port_open(), after installation. The following\ninterleaving is possible:\n\n 1. Install and release each obtain a reference with rfcomm_dev_get().\n 2. Release observes RFCOMM_TTY_OWNED clear.\n 3. Install sets RFCOMM_TTY_OWNED and drops the initial reference.\n 4. Release drops the same initial reference again.\n 5. TTY cleanup drops its reference and frees the device.\n 6. Release performs its final tty_port_put() on the freed port.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in tty_port_put+0x22/0x190\n Write of size 4 at addr ffff8881001d3d5c by task poc/92\n\n Call Trace:\n tty_port_put+0x22/0x190\n rfcomm_dev_ioctl+0x1d4/0x1930\n sock_do_ioctl+0x110/0x260\n sock_ioctl+0x380/0x590\n __x64_sys_ioctl+0x134/0x1c0\n\n Allocated by task 88:\n rfcomm_dev_ioctl+0x8f6/0x1930\n sock_do_ioctl+0x110/0x260\n sock_ioctl+0x380/0x590\n __x64_sys_ioctl+0x134/0x1c0\n\n Freed by task 65:\n kfree+0x131/0x3c0\n rfcomm_dev_destruct+0x23b/0x2f0\n release_one_tty+0xc1/0x370\n process_one_work+0x661/0x1090\n\nUse test_and_set_bit() in both paths so that only the caller that changes\nRFCOMM_TTY_OWNED from clear to set drops the initial reference. Each path\nkeeps its own lookup reference until release or TTY cleanup, preserving\nthe existing callback ordering and error handling."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/rfcomm/tty.c"], "versions": [{"version": "80ea73378af46b0023eb2f400d26c2a60248ffaa", "lessThan": "cd247e38b14df48d6b3940c4573a9f7acb10c363", "status": "affected", "versionType": "git"}, {"version": "80ea73378af46b0023eb2f400d26c2a60248ffaa", "lessThan": "d3dd18e85c140df72e0f2b5ee156ebfba04c06cb", "status": "affected", "versionType": "git"}, {"version": "80ea73378af46b0023eb2f400d26c2a60248ffaa", "lessThan": "c50360a019766fafa27318928bfea96dcce8a37d", "status": "affected", "versionType": "git"}, {"version": "80ea73378af46b0023eb2f400d26c2a60248ffaa", "lessThan": "55d162aa00d1ee33c3e6fa88b71f1e2d6e1441e9", "status": "affected", "versionType": "git"}, {"version": "80ea73378af46b0023eb2f400d26c2a60248ffaa", "lessThan": "a03ccf1ab77380d4c4a3c56552e12de4a83efa21", "status": "affected", "versionType": "git"}, {"version": "80ea73378af46b0023eb2f400d26c2a60248ffaa", "lessThan": "0a554901bd227537f79220443b2b36d585d62893", "status": "affected", "versionType": "git"}, {"version": "80ea73378af46b0023eb2f400d26c2a60248ffaa", "lessThan": "e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b", "status": "affected", "versionType": "git"}, {"version": "80ea73378af46b0023eb2f400d26c2a60248ffaa", "lessThan": "2d696c1ed3468dcb62578a3911e687110d463520", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/rfcomm/tty.c"], "versions": [{"version": "3.15", "status": "affected"}, {"version": "0", "lessThan": "3.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cd247e38b14df48d6b3940c4573a9f7acb10c363"}, {"url": "https://git.kernel.org/stable/c/d3dd18e85c140df72e0f2b5ee156ebfba04c06cb"}, {"url": "https://git.kernel.org/stable/c/c50360a019766fafa27318928bfea96dcce8a37d"}, {"url": "https://git.kernel.org/stable/c/55d162aa00d1ee33c3e6fa88b71f1e2d6e1441e9"}, {"url": "https://git.kernel.org/stable/c/a03ccf1ab77380d4c4a3c56552e12de4a83efa21"}, {"url": "https://git.kernel.org/stable/c/0a554901bd227537f79220443b2b36d585d62893"}, {"url": "https://git.kernel.org/stable/c/e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b"}, {"url": "https://git.kernel.org/stable/c/2d696c1ed3468dcb62578a3911e687110d463520"}], "title": "Bluetooth: RFCOMM: Fix initial port reference race", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/rfcomm/tty.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cd247e38b14df48d6b3940c4573a9f7acb10c363", "status": "affected", "version": "80ea73378af46b0023eb2f400d26c2a60248ffaa", "versionType": "git"}, {"lessThan": "d3dd18e85c140df72e0f2b5ee156ebfba04c06cb", "status": "affected", "version": "80ea73378af46b0023eb2f400d26c2a60248ffaa", "versionType": "git"}, {"lessThan": "c50360a019766fafa27318928bfea96dcce8a37d", "status": "affected", "version": "80ea73378af46b0023eb2f400d26c2a60248ffaa", "versionType": "git"}, {"lessThan": "55d162aa00d1ee33c3e6fa88b71f1e2d6e1441e9", "status": "affected", "version": "80ea73378af46b0023eb2f400d26c2a60248ffaa", "versionType": "git"}, {"lessThan": "a03ccf1ab77380d4c4a3c56552e12de4a83efa21", "status": "affected", "version": "80ea73378af46b0023eb2f400d26c2a60248ffaa", "versionType": "git"}, {"lessThan": "0a554901bd227537f79220443b2b36d585d62893", "status": "affected", "version": "80ea73378af46b0023eb2f400d26c2a60248ffaa", "versionType": "git"}, {"lessThan": "e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b", "status": "affected", "version": "80ea73378af46b0023eb2f400d26c2a60248ffaa", "versionType": "git"}, {"lessThan": "2d696c1ed3468dcb62578a3911e687110d463520", "status": "affected", "version": "80ea73378af46b0023eb2f400d26c2a60248ffaa", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/rfcomm/tty.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.15"}, {"lessThan": "3.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fix initial port reference race\n\nFor RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and\n__rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the\ninitial tty_port reference. The release path tests the bit separately\nfrom the install path setting it, so both can drop that reference.\n\nThe synchronous hangup does not prevent this race: port->tty is not\nassigned until tty_port_open(), after installation. The following\ninterleaving is possible:\n\n 1. Install and release each obtain a reference with rfcomm_dev_get().\n 2. Release observes RFCOMM_TTY_OWNED clear.\n 3. Install sets RFCOMM_TTY_OWNED and drops the initial reference.\n 4. Release drops the same initial reference again.\n 5. TTY cleanup drops its reference and frees the device.\n 6. Release performs its final tty_port_put() on the freed port.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in tty_port_put+0x22/0x190\n Write of size 4 at addr ffff8881001d3d5c by task poc/92\n\n Call Trace:\n tty_port_put+0x22/0x190\n rfcomm_dev_ioctl+0x1d4/0x1930\n sock_do_ioctl+0x110/0x260\n sock_ioctl+0x380/0x590\n __x64_sys_ioctl+0x134/0x1c0\n\n Allocated by task 88:\n rfcomm_dev_ioctl+0x8f6/0x1930\n sock_do_ioctl+0x110/0x260\n sock_ioctl+0x380/0x590\n __x64_sys_ioctl+0x134/0x1c0\n\n Freed by task 65:\n kfree+0x131/0x3c0\n rfcomm_dev_destruct+0x23b/0x2f0\n release_one_tty+0xc1/0x370\n process_one_work+0x661/0x1090\n\nUse test_and_set_bit() in both paths so that only the caller that changes\nRFCOMM_TTY_OWNED from clear to set drops the initial reference. Each path\nkeeps its own lookup reference until release or TTY cleanup, preserving\nthe existing callback ordering and error handling."}], "id": "CVE-2026-98739", "lastModified": "2026-10-30T13:21:22.550", "metrics": {}, "published": "2026-10-18T16:17:27.590", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0a554901bd227537f79220443b2b36d585d62893"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2d696c1ed3468dcb62578a3911e687110d463520"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/55d162aa00d1ee33c3e6fa88b71f1e2d6e1441e9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a03ccf1ab77380d4c4a3c56552e12de4a83efa21"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c50360a019766fafa27318928bfea96dcce8a37d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cd247e38b14df48d6b3940c4573a9f7acb10c363"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d3dd18e85c140df72e0f2b5ee156ebfba04c06cb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Bluetooth: RFCOMM: Fix initial port reference race", "id": "2555051", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555051"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: RFCOMM: Fix initial port reference race\nFor RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and\n__rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the\ninitial tty_port reference. The release path tests the bit separately\nfrom the install path setting it, so both can drop that reference.\nThe synchronous hangup does not prevent this race: port->tty is not\nassigned until tty_port_open(), after installation. The following\ninterleaving is possible:\n1. Install and release each obtain a reference with rfcomm_dev_get().\n2. Release observes RFCOMM_TTY_OWNED clear.\n3. Install sets RFCOMM_TTY_OWNED and drops the initial reference.\n4. Release drops the same initial reference again.\n5. TTY cleanup drops its reference and frees the device.\n6. Release performs its final tty_port_put() on the freed port.\nKASAN reported:\nBUG: KASAN: slab-use-after-free in tty_port_put+0x22/0x190\nWrite of size 4 at addr ffff8881001d3d5c by task poc/92\nCall Trace:\ntty_port_put+0x22/0x190\nrfcomm_dev_ioctl+0x1d4/0x1930\nsock_do_ioctl+0x110/0x260\nsock_ioctl+0x380/0x590\n__x64_sys_ioctl+0x134/0x1c0\nAllocated by task 88:\nrfcomm_dev_ioctl+0x8f6/0x1930\nsock_do_ioctl+0x110/0x260\nsock_ioctl+0x380/0x590\n__x64_sys_ioctl+0x134/0x1c0\nFreed by task 65:\nkfree+0x131/0x3c0\nrfcomm_dev_destruct+0x23b/0x2f0\nrelease_one_tty+0xc1/0x370\nprocess_one_work+0x661/0x1090\nUse test_and_set_bit() in both paths so that only the caller that changes\nRFCOMM_TTY_OWNED from clear to set drops the initial reference. Each path\nkeeps its own lookup reference until release or TTY cleanup, preserving\nthe existing callback ordering and error handling.", "A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. A local user could exploit this flaw to cause a Denial of Service (DoS) or potentially escalate privileges. A race condition between concurrent device installation and release operations allows reference counts to be dropped prematurely, resulting in a use-after-free condition and system crash."], "name": "CVE-2026-98739", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98739\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98739\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98739.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[80ea73378af46b0023eb2f400d26c2a60248ffaa,a03ccf1ab77380d4c4a3c56552e12de4a83efa21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[80ea73378af46b0023eb2f400d26c2a60248ffaa,0a554901bd227537f79220443b2b36d585d62893)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[80ea73378af46b0023eb2f400d26c2a60248ffaa,e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[80ea73378af46b0023eb2f400d26c2a60248ffaa,2d696c1ed3468dcb62578a3911e687110d463520)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T20:15:14.858418+00:00", "updated": "2026-10-23T23:00:13.550328+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}