In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO The… (CVE-2026-98455)

The Linux kernel Bluetooth RFCOMM subsystem had a vulnerability (CVE-2026-98455) where the RFCOMM_CONNINFO getsockopt handler could dereference a NULL pointer. This happens because the deferred setup flag (dlc->defer_setup) remains set even after the session pointer (dlc->session) is cleared during socket teardown. When getsockopt is called on such a socket, the code skips the usual connection state check and dereferences the NULL session pointer, causing a kernel crash. The flaw was reproduced under KASAN in QEMU. The fix involves restricting the deferred setup exception to sockets in the BT_CONNECT2 state and checking that the session pointer is valid before dereferencing it.

This vulnerability can cause a kernel crash (general protection fault) due to a NULL pointer dereference in the Bluetooth RFCOMM getsockopt handler. This results in denial of service on affected systems. There is no indication of privilege escalation or information disclosure. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to restrict the deferred setup exception to the BT_CONNECT2 state and to verify the session pointer before dereferencing it. Users should update to a Linux kernel version that includes this fix. Since no patch links or specific fixed versions are provided, check the vendor or kernel mailing lists for the official patch and apply it accordingly.