The vulnerability in the Linux kernel's Bluetooth RFCOMM subsystem (CVE-2026-89569) arises because rfcomm_security_cfm() accesses session and DLC lists without holding the rfcomm_mutex, while session teardown operations do hold this mutex. This race condition allows concurrent freeing of session and DLC objects, causing use-after-free errors. The flaw was detected by KASAN, which reported slab-use-after-free during rfcomm_security_cfm execution. The fix serializes session lookup and DLC traversal in rfcomm_security_cfm() with rfcomm_mutex to prevent concurrent teardown during callback use.

This vulnerability can cause use-after-free memory corruption in the Bluetooth RFCOMM kernel code, potentially leading to kernel crashes or undefined behavior. No confirmed exploits in the wild are reported. The impact is limited to systems running vulnerable Linux kernel versions with Bluetooth RFCOMM enabled.

A fix has been implemented that serializes access in rfcomm_security_cfm() using rfcomm_mutex, preventing concurrent session and DLC teardown during security confirmation handling. Users should apply the official Linux kernel patches that address this issue when available. Patch status is not explicitly stated in the input; check the vendor advisory for current remediation guidance.