CVE-2026-10654: race in zephyrproject zephyr
A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rfcomm.c) mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown (state BT_RFCOMM_STATE_DISCONNECTING, DISC sent, RTX timer armed) and the connected peer concurrently sends its own DISC frame for dlci 0, rfcomm_handle_disc() invokes rfcomm_session_disconnected(), which unconditionally forced the session to BT_RFCOMM_STATE_DISCONNECTED without ever calling bt_l2cap_chan_disconnect(). Because the recovery timer was also cancelled and a later UA is ignored in the DISCONNECTED state, the session becomes permanently wedged: the underlying L2CAP channel is never released and the session slot in the fixed bt_rfcomm_pool[CONFIG_BT_MAX_CONN] array is never reclaimed (its conn pointer stays set). Subsequent bt_rfcomm_dlc_connect() calls on that connection fail with -EINVAL due to the invalid session state, so RFCOMM service is denied for that peer, and repeated occurrences can exhaust the session pool. The DISC frame is peer-controlled over the air, but exploitation requires the peer's DISC to collide with a local-initiated disconnect (a high-complexity timing race). Impact is availability/resource-leak only; there is no memory-safety, confidentiality, or integrity consequence. The defect shipped in released versions (present in v4.4.0 and earlier). The fix only transitions to DISCONNECTED when the session is not already in DISCONNECTING, preserving the proper L2CAP teardown path.
AI Analysis
Technical Summary
The vulnerability is a race condition in Zephyr's Bluetooth Classic RFCOMM host stack (rfcomm.c) where concurrent disconnect requests from the local device and the peer cause improper session state handling. Specifically, if the local device initiates a disconnect and the peer simultaneously sends a DISC frame, the session state forcibly transitions to DISCONNECTED without properly disconnecting the underlying L2CAP channel. This leaves the session slot unreleased and the connection pointer set, causing subsequent connection attempts to fail and denying RFCOMM service. The defect is present in version 1.6.0 and earlier. The fix involves ensuring the session only transitions to DISCONNECTED if not already in DISCONNECTING, preserving correct L2CAP teardown.
Potential Impact
The vulnerability causes a denial of service by wedging the RFCOMM session state and leaking session resources. This prevents new RFCOMM connections from being established with the affected peer and can exhaust the session pool. There are no impacts on confidentiality, integrity, or memory safety. Exploitation requires a precise timing race between local and peer disconnects.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, be aware that exploitation requires a complex timing race and impacts availability only. No other mitigation steps are explicitly provided.
CVE-2026-10654: race in zephyrproject zephyr
Description
A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rfcomm.c) mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown (state BT_RFCOMM_STATE_DISCONNECTING, DISC sent, RTX timer armed) and the connected peer concurrently sends its own DISC frame for dlci 0, rfcomm_handle_disc() invokes rfcomm_session_disconnected(), which unconditionally forced the session to BT_RFCOMM_STATE_DISCONNECTED without ever calling bt_l2cap_chan_disconnect(). Because the recovery timer was also cancelled and a later UA is ignored in the DISCONNECTED state, the session becomes permanently wedged: the underlying L2CAP channel is never released and the session slot in the fixed bt_rfcomm_pool[CONFIG_BT_MAX_CONN] array is never reclaimed (its conn pointer stays set). Subsequent bt_rfcomm_dlc_connect() calls on that connection fail with -EINVAL due to the invalid session state, so RFCOMM service is denied for that peer, and repeated occurrences can exhaust the session pool. The DISC frame is peer-controlled over the air, but exploitation requires the peer's DISC to collide with a local-initiated disconnect (a high-complexity timing race). Impact is availability/resource-leak only; there is no memory-safety, confidentiality, or integrity consequence. The defect shipped in released versions (present in v4.4.0 and earlier). The fix only transitions to DISCONNECTED when the session is not already in DISCONNECTING, preserving the proper L2CAP teardown path.
CVSS v3.1
Score 3.1low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability is a race condition in Zephyr's Bluetooth Classic RFCOMM host stack (rfcomm.c) where concurrent disconnect requests from the local device and the peer cause improper session state handling. Specifically, if the local device initiates a disconnect and the peer simultaneously sends a DISC frame, the session state forcibly transitions to DISCONNECTED without properly disconnecting the underlying L2CAP channel. This leaves the session slot unreleased and the connection pointer set, causing subsequent connection attempts to fail and denying RFCOMM service. The defect is present in version 1.6.0 and earlier. The fix involves ensuring the session only transitions to DISCONNECTED if not already in DISCONNECTING, preserving correct L2CAP teardown.
Potential Impact
The vulnerability causes a denial of service by wedging the RFCOMM session state and leaking session resources. This prevents new RFCOMM connections from being established with the affected peer and can exhaust the session pool. There are no impacts on confidentiality, integrity, or memory safety. Exploitation requires a precise timing race between local and peer disconnects.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, be aware that exploitation requires a complex timing race and impacts availability only. No other mitigation steps are explicitly provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-02T15:24:28.191Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a43f42f27e9c79719185ec4
Added to database: 06/30/2026, 16:51:59 UTC
Last enriched: 07/15/2026, 10:47:38 UTC
Last updated: 08/14/2026, 12:41:08 UTC
Views: 91
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.