Look up another CVE · open CVE-2026-89569 in the interactive tracker
CVE-2026-89569
Bluetooth: RFCOMM: serialize security confirmation handling
Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem net/bluetooth. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-89569 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
rfcomm_security_cfm() looks up a session on session_list and then walks its DLC list without holding rfcomm_mutex. Since RFCOMM session teardown uses rfcomm_mutex, krfcommd can close and free the same session and DLCs concurrently: hci_rx_work krfcommd ----------- --------- rfcomm_session_get() rfcomm_lock() rfcomm_session_close() rfcomm_dlc_unlink() rfcomm_session_del() kfree(s) rfcomm_unlock() walk s->dlcs The callback can then read a freed session list head and touch freed DLCs while updating their flags or timers. Serialize the session lookup and DLC traversal in rfcomm_security_cfm() with rfcomm_mutex. This matches the existing RFCOMM session lifetime rules and prevents concurrent rfcomm_session_del() / rfcomm_dlc_unlink() from tearing the objects down while the callback is using them. KASAN reported: BUG: KASAN: slab-use-after-free in rfcomm_security_cfm+0x41c/0x440 Read of size 8 at addr ffff888111fb3960 by task kworker/u17:1/89 Workqueue: hci0 hci_rx_work Call Trace: rfcomm_security_cfm+0x41c/0x440 hci_encrypt_cfm+0x139/0x590 hci_encrypt_change_evt+0x37b/0xc40 hci_event_packet+0x71b/0xb20 hci_rx_work+0x293/0x730 Allocated by task 69: rfcomm_session_add+0x9e/0x2f0 rfcomm_run+0x44b/0x41e0 Freed by task 69: kfree+0x131/0x3c0 rfcomm_session_del+0x188/0x220 rfcomm_run+0x1985/0x41e0
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/bluetooth/rfcomm/core.c
- What this is
- BLUETOOTH SUBSYSTEMMAINTAINERS section matched on net/bluetooth/ · linux-bluetooth@vger.kernel.org · Supported
- Kernel module
- rfcomm
Check it on the machine
grep -wE 'CONFIG_BT|CONFIG_BT_RFCOMM' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w rfcommPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x
- bookworm · linux-6.12Mnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_BT, CONFIG_BT_RFCOMM
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-11 (37 days ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.34%, higher than 26.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/bluetooth
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.10 | 5.10.270 | 62ce8b33eb23 |
| 3.10 | 5.15.221 | 3873f3449701 |
| 3.10 | 6.1.188 | 7ded32641064 |
| 3.10 | 6.6.157 | 82425b14f0fb |
| 3.10 | 6.12.109 | 1b7841ffad08 |
| 3.10 | 6.18.50 | 946d76db77ee |
| 3.10 | 7.2.4 | fbf7961964a6 |
| 3.10 | 7.3 | 759c185d0bbd |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- rfcomm_security_cfm() runs from hci_encrypt_cfm()/hci_auth_cfm() on hci_rx_work when the controller reports encryption or authentication complete. An in-range Bluetooth peer that opens an RFCOMM/L2CAP session can drive those HCI events; kernel CNA guidance scores Bluetooth as Adjacent.
- AC:LAttack complexity, low
- The UAF is a race between hci_rx_work walking the session and krfcommd freeing it. A peer controls both sides by triggering encrypt/auth complete while disconnecting RFCOMM/L2CAP or the ACL link so krfcommd runs rfcomm_session_close(), and can retry until the window is hit.
- PR:NPrivileges required, none
- A nearby Bluetooth device needs no Linux account or capability. krfcommd listens on L2CAP PSM RFCOMM at default BT_SECURITY_LOW, and HCI encrypt/auth complete (including failures) call rfcomm_security_cfm() with no local credential check.
- UI:NUser interaction, none
- Phones, cars, and IoT devices with Bluetooth enabled accept RFCOMM/L2CAP and emit encrypt-change events during ordinary link setup or teardown. No extra victim action such as pairing confirmation, mounting, or opening a file is required at exploit time.
- S:UScope, unchanged
- The UAF corrupts kernel RFCOMM session and DLC objects in the host Bluetooth stack. It does not cross a VM, IOMMU, or other security-authority boundary.
- C:HConfidentiality impact, high
- After rfcomm_session_del() frees the session, the callback reads the slab-freed list head and DLC flags, state, and sec_level. Kernel UAF of these objects enables heap reuse and arbitrary kernel read primitives.
- I:HIntegrity impact, high
- The callback writes DLC flag bits and arms or cancels DLC timers on objects krfcommd may already have unlinked and freed, so a reused slab object can be corrupted or have its timer hijacked for control-flow takeover.
- A:HAvailability impact, high
- KASAN reported slab-use-after-free in rfcomm_security_cfm() on hci_rx_work; triggering the race oopses or panics the kernel even without a full exploit.