In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex An RFCOMM… (CVE-2026-99009)

CVE-2026-99009 addresses a circular locking dependency in the Linux kernel Bluetooth RFCOMM code. The vulnerability arises because an RFCOMM connect() call and HCI event callbacks acquire locks in opposite orders (rfcomm_mutex and hdev->lock), causing lockdep to report a circular dependency and potential deadlocks. The patch modifies rfcomm_session_create() to connect the session socket before acquiring rfcomm_mutex, removing the rfcomm_mutex -> hdev->lock lock order. It also adds logic to handle cases where the socket may be closed during connection setup, preventing use-after-free scenarios. This fix ensures consistent lock acquisition order and improves stability during Bluetooth RFCOMM connections.

The vulnerability causes a circular locking dependency that can lead to kernel warnings and potential deadlocks during Bluetooth RFCOMM socket connections. While no direct exploit or code execution impact is described, the issue affects kernel stability and reliability when establishing RFCOMM connections over BR/EDR links that are authenticating and encrypting. There are no known exploits in the wild.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to eliminate the circular locking dependency. No additional mitigation steps are required beyond updating to a fixed kernel version once available.