---
id: CVE-2026-98739
title: 'Bluetooth: RFCOMM: Fix initial port reference race'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: RFCOMM: Fix initial port reference race

  For RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and
  __rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decid…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa <
    a03ccf1ab77380d4c4a3c56552e12de4a83efa21
  - >-
    Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa <
    0a554901bd227537f79220443b2b36d585d62893
  - >-
    Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa <
    e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b
  - >-
    Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa <
    2d696c1ed3468dcb62578a3911e687110d463520
  - Linux 3.15
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:47:23.653Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98739'
references:
  - url: 'https://git.kernel.org/stable/c/a03ccf1ab77380d4c4a3c56552e12de4a83efa21'
  - url: 'https://git.kernel.org/stable/c/0a554901bd227537f79220443b2b36d585d62893'
  - url: 'https://git.kernel.org/stable/c/e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b'
  - url: 'https://git.kernel.org/stable/c/2d696c1ed3468dcb62578a3911e687110d463520'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.504Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Fix initial port reference race

For RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and
__rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the
initial tty_port reference. The release path tests the bit separately
from the install path setting it, so both can drop that reference.

The synchronous hangup does not prevent this race: port->tty is not
assigned until tty_port_open(), after installation. The following
interleaving is possible:

  1. Install and release each obtain a reference with rfcomm_dev_get().
  2. Release observes RFCOMM_TTY_OWNED clear.
  3. Install sets RFCOMM_TTY_OWNED and drops the initial reference.
  4. Release drops the same initial reference again.
  5. TTY cleanup drops its reference and frees the device.
  6. Release performs its final tty_port_put() on the freed port.

KASAN reported:

  BUG: KASAN: slab-use-after-free in tty_port_put+0x22/0x190
  Write of size 4 at addr ffff8881001d3d5c by task poc/92

  Call Trace:
   tty_port_put+0x22/0x190
   rfcomm_dev_ioctl+0x1d4/0x1930
   sock_do_ioctl+0x110/0x260
   sock_ioctl+0x380/0x590
   __x64_sys_ioctl+0x134/0x1c0

  Allocated by task 88:
   rfcomm_dev_ioctl+0x8f6/0x1930
   sock_do_ioctl+0x110/0x260
   sock_ioctl+0x380/0x590
   __x64_sys_ioctl+0x134/0x1c0

  Freed by task 65:
   kfree+0x131/0x3c0
   rfcomm_dev_destruct+0x23b/0x2f0
   release_one_tty+0xc1/0x370
   process_one_work+0x661/0x1090

Use test_and_set_bit() in both paths so that only the caller that changes
RFCOMM_TTY_OWNED from clear to set drops the initial reference. Each path
keeps its own lookup reference until release or TTY cleanup, preserving
the existing callback ordering and error handling.

## Affected

- `Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa < a03ccf1ab77380d4c4a3c56552e12de4a83efa21`
- `Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa < 0a554901bd227537f79220443b2b36d585d62893`
- `Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa < e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b`
- `Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa < 2d696c1ed3468dcb62578a3911e687110d463520`
- `Linux 3.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.