CVE-2026-53256

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

rfcomm_get_sock_by_channel() scans rfcomm_sk_list under the list lock,

but returns the selected listener after dropping that lock without

taking a reference. rfcomm_connect_ind() then locks the listener,

queues a child socket on it, and may notify it after unlocking it.

The buggy scenario involves two paths, with each column showing the

order within that path:

rfcomm_connect_ind(): listener close:

1. Find parent in 1. close() enters

rfcomm_get_sock_by_channel() rfcomm_sock_release().

2. Drop rfcomm_sk_list.lock 2. rfcomm_sock_shutdown()

without pinning parent. closes the listener.

3. Call lock_sock(parent) and 3. rfcomm_sock_kill()

bt_accept_enqueue(parent, unlinks and puts parent.

sk, true).

4. Read parent flags and may 4. parent can be freed.

call sk_state_change().

If clos

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References