CVE-2026-68188

Bluetooth: RFCOMM: Fix session UAF in set_termios

State: Published
Severity: Not scored
Published: Aug 10, 2026
Updated: Aug 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Fix session UAF in set_termios

rfcomm_tty_set_termios() tests dlc->session without rfcomm_mutex and later passes the pointer to rfcomm_send_rpn(). The latter dereferences both session->initiator and session->sock. Meanwhile, krfcommd can unlink the DLC and free the session while holding rfcomm_mutex.

The race can proceed as follows:

TTY ioctl task krfcommd -------------- -------- load dlc->session enter rfcomm_send_rpn() lock rfcomm_mutex clear dlc->session free session unlock rfcomm_mutex read session->initiator

KASAN reported:

BUG: KASAN: slab-use-after-free in rfcomm_send_rpn+0x297/0x2a0 Read of size 4 at addr ffff88810012a850 by task poc/92

Call Trace: rfcomm_send_rpn+0x297/0x2a0 rfcomm_tty_set_termios+0x50d/0x850 tty_set_termios+0x596/0x950 set_termios+0x46a/0x6e0 tty_mode_ioctl+0x152/0xbd0 tty_ioctl+0x915/0x1240 __x64_sys_ioctl+0x134/0x1c0

Allocated by task 92: rfcomm_session_add+0x9e/0x2e0 rfcomm_dlc_open+0x8b1/0xe00 rfcomm_dev_activate+0x85/0x1a0 rfcomm_tty_open+0x90/0x280

Freed by task 68: kfree+0x131/0x3c0 rfcomm_session_del+0x119/0x180 rfcomm_run+0x737/0x4710

Add rfcomm_dlc_send_rpn(), which holds rfcomm_mutex while it verifies that the DLC is still attached and sends the RPN frame. Have the TTY path use the helper and drop its unlocked session check. This keeps the session valid through both the frame construction and socket send.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3a5e903c09aed19ca4a1bb26d87b8d6461a93818 to before 4eac4576a072084b06459de6c054b4ebc764b4eaAffected 3a5e903c09aed19ca4a1bb26d87b8d6461a93818 to before 82c383f9031f1ce919ac6c3c06bc5bd492a6b078Affected 3a5e903c09aed19ca4a1bb26d87b8d6461a93818 to before c5c060597247131f90f39ea7c8c978fa0c2e79d0Affected 3a5e903c09aed19ca4a1bb26d87b8d6461a93818 to before 2894bd8c68e97accd758ca6e5fc375d7e9e8882cAffected 3a5e903c09aed19ca4a1bb26d87b8d6461a93818 to before a82a9d3891f5607030b0672c255087a12bb9837bAffected 3a5e903c09aed19ca4a1bb26d87b8d6461a93818 to before 780b04d09c941262ee2a2b4a09906451b69df8a6Affected 3a5e903c09aed19ca4a1bb26d87b8d6461a93818 to before 98bc68194e37bfa5e8ddc80b5c1eb0be4dc607eaAffected 3a5e903c09aed19ca4a1bb26d87b8d6461a93818 to before c783399efc22d035443f1dfbf2a09bf9562aaa5eAffected
LinuxLinux	2.6.14Affected before 2.6.14Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

3a5e903c09aed19ca4a1bb26d87b8d6461a93818 to before 4eac4576a072084b06459de6c054b4ebc764b4eaAffected
3a5e903c09aed19ca4a1bb26d87b8d6461a93818 to before 82c383f9031f1ce919ac6c3c06bc5bd492a6b078Affected
3a5e903c09aed19ca4a1bb26d87b8d6461a93818 to before c5c060597247131f90f39ea7c8c978fa0c2e79d0Affected
3a5e903c09aed19ca4a1bb26d87b8d6461a93818 to before 2894bd8c68e97accd758ca6e5fc375d7e9e8882cAffected
3a5e903c09aed19ca4a1bb26d87b8d6461a93818 to before a82a9d3891f5607030b0672c255087a12bb9837bAffected
3a5e903c09aed19ca4a1bb26d87b8d6461a93818 to before 780b04d09c941262ee2a2b4a09906451b69df8a6Affected
3a5e903c09aed19ca4a1bb26d87b8d6461a93818 to before 98bc68194e37bfa5e8ddc80b5c1eb0be4dc607eaAffected
3a5e903c09aed19ca4a1bb26d87b8d6461a93818 to before c783399efc22d035443f1dfbf2a09bf9562aaa5eAffected

LinuxLinux

2.6.14Affected
before 2.6.14Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.