CVE-2026-98455: Linux kernel · Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in c7362f6a18ed167f52f08ce25eeec8a7818c5004 : patch Linux kernel soon.
Data as of 26 Oct 2026, 14:05 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in c7362f6a18ed167f52f08ce25eeec8a7818c5004, c3aee3fc1287c8a555baf3895959087cb0c33fe8, 84ae3cfd7d3a63591a2eb4faa24faf678c6708aa +5
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix for this vulnerability is available in the Linux kernel as indicated by multiple fixed commit versions. Users and administrators should update their Linux kernel to a version that includes these fixes to prevent exploitation. No additional mitigation steps are indicated or required beyond applying the official patch.
Description
A NULL pointer dereference vulnerability exists in the Linux kernel's Bluetooth RFCOMM implementation. Specifically, the getsockopt handler for RFCOMM_CONNINFO can dereference a NULL session pointer when deferred setup is enabled and the socket state is BT_CLOSED. This occurs because the session pointer is cleared while the defer_setup flag remains set, leading to an unconditional dereference. This flaw can cause a kernel crash (general protection fault) when a getsockopt call is made on an accepted socket after a remote disconnect (DISC) has been processed.
References
- git.kernel.org/stable/c/c3aee3fc1287c8a555baf3895959087cb0c33fe8 (opens in a new tab)
- git.kernel.org/stable/c/4bf5ca47203049ce3648f750a53dcdc98bcc9e3e (opens in a new tab)
- git.kernel.org/stable/c/1c4f7e1177da2f229be04139c27e5370a1cfba52 (opens in a new tab)
- git.kernel.org/stable/c/84ae3cfd7d3a63591a2eb4faa24faf678c6708aa (opens in a new tab)
- git.kernel.org/stable/c/c7362f6a18ed167f52f08ce25eeec8a7818c5004 (opens in a new tab)
- git.kernel.org/stable/c/8f5b30cc12c409ff62891e47ed51e6bf0945a3ea (opens in a new tab)
- git.kernel.org/stable/c/005b23d9e324fe5d0acbcfa70c625f2e81189046 (opens in a new tab)
- git.kernel.org/stable/c/46f8ffd0a1f1eb6cbc94946a92c11ef601e228a1 (opens in a new tab)