{"id":41211,"date":"2026-10-19T00:32:38","date_gmt":"2026-10-18T16:32:38","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98739"},"modified":"2026-10-19T00:32:38","modified_gmt":"2026-10-18T16:32:38","slug":"cve-2026-98739","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98739","title":{"rendered":"CVE-2026-98739 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fi"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>Bluetooth: RFCOMM: Fix initial port reference race<\/p>\n<p>For RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and<br \/>\n__rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the<br \/>\ninitial tty_port reference. The release path tests the bit separately<br \/>\nfrom the install path setting it, so both can drop that reference.<\/p>\n<p>The synchronous hangup does not prevent this race: port-&gt;tty is not<br \/>\nassigned until tty_port_open(), after installation. The following<br \/>\ninterleaving is possible:<\/p>\n<p>  1. Install and release each obtain a reference with rfcomm_dev_get().<br \/>\n  2. Release observes RFCOMM_TTY_OWNED clear.<br \/>\n  3. Install sets RFCOMM_TTY_OWNED and drops the initial reference.<br \/>\n  4. Release drops the same initial reference again.<br \/>\n  5. TTY cleanup drops its reference and frees the device.<br \/>\n  6. Release performs its final tty_port_put() on the freed port.<\/p>\n<p>KASAN reported:<\/p>\n<p>  BUG: KASAN: slab-use-after-free in tty_port_put+0x22\/0x190<br \/>\n  Write of size 4 at addr ffff8881001d3d5c by task poc\/92<\/p>\n<p>  Call Trace:<br \/>\n   tty_port_put+0x22\/0x190<br \/>\n   rfcomm_dev_ioctl+0x1d4\/0x1930<br \/>\n   sock_do_ioctl+0x110\/0x260<br \/>\n   sock_ioctl+0x380\/0x590<br \/>\n   __x64_sys_ioctl+0x134\/0x1c0<\/p>\n<p>  Allocated by task 88:<br \/>\n   rfcomm_dev_ioctl+0x8f6\/0x1930<br \/>\n   sock_do_ioctl+0x110\/0x260<br \/>\n   sock_ioctl+0x380\/0x590<br \/>\n   __x64_sys_ioctl+0x134\/0x1c0<\/p>\n<p>  Freed by task 65:<br \/>\n   kfree+0x131\/0x3c0<br \/>\n   rfcomm_dev_destruct+0x23b\/0x2f0<br \/>\n   release_one_tty+0xc1\/0x370<br \/>\n   process_one_work+0x661\/0x1090<\/p>\n<p>Use test_and_set_bit() in both paths so that only the caller that changes<br \/>\nRFCOMM_TTY_OWNED from clear to set drops the initial reference. Each path<br \/>\nkeeps its own lookup reference until release or TTY cleanup, preserving<br \/>\nthe existing callback ordering and error handling.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>Bluetooth: RFCOMM: Fix initial port reference race<\/p>\n<p>For RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and<br \/>\n__rfcomm_release_dev<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41211","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41211","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41211"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41211"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41211"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}