VulnerabilityPublished 18 Oct 2026

CVE-2026-98455: Linux kernel · Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

Source GCVE Database

Authoritative record:CVE-2026-98455· High

Not known to be exploited · fixed in c7362f6a18ed167f52f08ce25eeec8a7818c5004 : patch Linux kernel soon.

Data as of 26 Oct 2026, 14:05 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in c7362f6a18ed167f52f08ce25eeec8a7818c5004, c3aee3fc1287c8a555baf3895959087cb0c33fe8, 84ae3cfd7d3a63591a2eb4faa24faf678c6708aa +5

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-5qmc-rg3w-hx9m

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ bb23c0ab824653be4aa7dfca15b07b3059717004, < c7362f6a18ed167f52f08ce25eeec8a7818c5004	Fixed in c7362f6a18ed167f52f08ce25eeec8a7818c5004
LinuxLinux	Affected ≥ bb23c0ab824653be4aa7dfca15b07b3059717004, < c3aee3fc1287c8a555baf3895959087cb0c33fe8	Fixed in c3aee3fc1287c8a555baf3895959087cb0c33fe8
LinuxLinux	Affected ≥ bb23c0ab824653be4aa7dfca15b07b3059717004, < 84ae3cfd7d3a63591a2eb4faa24faf678c6708aa	Fixed in 84ae3cfd7d3a63591a2eb4faa24faf678c6708aa
LinuxLinux	Affected ≥ bb23c0ab824653be4aa7dfca15b07b3059717004, < 46f8ffd0a1f1eb6cbc94946a92c11ef601e228a1	Fixed in 46f8ffd0a1f1eb6cbc94946a92c11ef601e228a1
LinuxLinux	Affected ≥ bb23c0ab824653be4aa7dfca15b07b3059717004, < 8f5b30cc12c409ff62891e47ed51e6bf0945a3ea	Fixed in 8f5b30cc12c409ff62891e47ed51e6bf0945a3ea
LinuxLinux	Affected ≥ bb23c0ab824653be4aa7dfca15b07b3059717004, < 005b23d9e324fe5d0acbcfa70c625f2e81189046	Fixed in 005b23d9e324fe5d0acbcfa70c625f2e81189046

AI-suggested

A fix has been implemented in the Linux kernel to restrict the deferred setup exception to the BT_CONNECT2 state and to verify the session pointer before dereferencing it. Users should update to a Linux kernel version that includes this fix.

Description

A NULL pointer dereference vulnerability in the Linux kernel's Bluetooth RFCOMM implementation was resolved. The flaw occurs in the RFCOMM_CONNINFO getsockopt handler when it dereferences a NULL session pointer due to improper handling of deferred setup sockets after disconnection. This can cause a kernel crash (general protection fault) when getsockopt is called on an accepted socket after the remote side disconnects. The issue arises because the session pointer is cleared while the defer_setup flag remains set, leading to unconditional dereference without a race condition. The vulnerability was fixed by restricting the exception to a specific socket state and verifying the session pointer before use.

Impact

This vulnerability can cause a kernel crash (general protection fault) due to a NULL pointer dereference in the Bluetooth RFCOMM getsockopt handler. This results in denial of service on affected systems. There is no indication of privilege escalation or information disclosure. No known exploits in the wild have been reported.

Summary

The Linux kernel Bluetooth RFCOMM subsystem had a vulnerability (CVE-2026-98455) where the RFCOMM_CONNINFO getsockopt handler could dereference a NULL pointer. This happens because the deferred setup flag (dlc->defer_setup) remains set even after the session pointer (dlc->session) is cleared during socket teardown. When getsockopt is called on such a socket, the code skips the usual connection state check and dereferences the NULL session pointer, causing a kernel crash. The flaw was reproduced under KASAN in QEMU. The fix involves restricting the deferred setup exception to sockets in the BT_CONNECT2 state and checking that the session pointer is valid before dereferencing it.

References

Community reviews

Loading reviews…