In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMM_RELEASE_ONHUP… (CVE-2026-98739)

The vulnerability in the Linux kernel Bluetooth RFCOMM subsystem arises from a race condition between rfcomm_tty_install() and __rfcomm_release_dev() functions regarding the management of the initial tty_port reference. Both functions use the RFCOMM_TTY_OWNED bit to decide who should drop this reference, but the release path tests the bit separately from the install path setting it, allowing both to drop the same reference. This leads to a use-after-free scenario when the tty_port is freed and then accessed again. The fix involves using test_and_set_bit() in both paths to ensure only the caller that sets the RFCOMM_TTY_OWNED bit drops the initial reference, preserving proper reference counting and preventing the race.

The vulnerability can lead to a use-after-free condition in the Bluetooth RFCOMM code of the Linux kernel, which may cause kernel memory corruption or crashes. This could potentially be exploited to cause denial of service or other unintended kernel behavior. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this race condition by using atomic operations to manage the RFCOMM_TTY_OWNED bit, ensuring correct reference counting. Users should update to the fixed kernel version once available. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a patched kernel release is the recommended remediation.