VulnerabilityPublished 18 Oct 2026

CVE-2026-98739: Linux kernel · Bluetooth: RFCOMM: Fix initial port reference race

Source GCVE Database

Authoritative record:CVE-2026-98739

Not known to be exploited · fixed in e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b : patch Linux kernel soon.

Data as of 26 Oct 2026, 12:55 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b, a03ccf1ab77380d4c4a3c56552e12de4a83efa21, 55d162aa00d1ee33c3e6fa88b71f1e2d6e1441e9 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-jg2j-fxrh-w676

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 80ea73378af46b0023eb2f400d26c2a60248ffaa, < e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b	Fixed in e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b
LinuxLinux	Affected ≥ 80ea73378af46b0023eb2f400d26c2a60248ffaa, < a03ccf1ab77380d4c4a3c56552e12de4a83efa21	Fixed in a03ccf1ab77380d4c4a3c56552e12de4a83efa21
LinuxLinux	Affected ≥ 80ea73378af46b0023eb2f400d26c2a60248ffaa, < 55d162aa00d1ee33c3e6fa88b71f1e2d6e1441e9	Fixed in 55d162aa00d1ee33c3e6fa88b71f1e2d6e1441e9
LinuxLinux	Affected ≥ 80ea73378af46b0023eb2f400d26c2a60248ffaa, < 2d696c1ed3468dcb62578a3911e687110d463520	Fixed in 2d696c1ed3468dcb62578a3911e687110d463520
LinuxLinux	Affected ≥ 80ea73378af46b0023eb2f400d26c2a60248ffaa, < 0a554901bd227537f79220443b2b36d585d62893	Fixed in 0a554901bd227537f79220443b2b36d585d62893
LinuxLinux	Affected =3.15	Fixed in–

AI-suggested

A fix has been implemented in the Linux kernel to address this race condition by using atomic operations to manage the RFCOMM_TTY_OWNED bit, ensuring correct reference counting. Users should update to the fixed kernel version once available. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a patched kernel release is the recommended remediation.

Description

A race condition vulnerability in the Linux kernel's Bluetooth RFCOMM implementation was resolved. The issue involves improper handling of the initial port reference in RFCOMM_RELEASE_ONHUP devices, where concurrent install and release operations can cause a use-after-free condition. This occurs because both rfcomm_tty_install() and __rfcomm_release_dev() functions can drop the same reference due to a race in setting and testing the RFCOMM_TTY_OWNED bit. The flaw was detected by KASAN as a slab-use-after-free error.

Impact

The vulnerability can lead to a use-after-free condition in the Bluetooth RFCOMM code of the Linux kernel, which may cause kernel memory corruption or crashes. This could potentially be exploited to cause denial of service or other unintended kernel behavior. No known exploits in the wild have been reported.

Summary

The vulnerability in the Linux kernel Bluetooth RFCOMM subsystem arises from a race condition between rfcomm_tty_install() and __rfcomm_release_dev() functions regarding the management of the initial tty_port reference. Both functions use the RFCOMM_TTY_OWNED bit to decide who should drop this reference, but the release path tests the bit separately from the install path setting it, allowing both to drop the same reference. This leads to a use-after-free scenario when the tty_port is freed and then accessed again. The fix involves using test_and_set_bit() in both paths to ensure only the caller that sets the RFCOMM_TTY_OWNED bit drops the initial reference, preserving proper reference counting and preventing the race.

References

Community reviews

Loading reviews…