CVE-2026-89569

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: serialize security confirmation handling

rfcomm_security_cfm() looks up a session on session_list and then walks

its DLC list without holding rfcomm_mutex. Since RFCOMM session teardown

uses rfcomm_mutex, krfcommd can close and free the same session and DLCs

concurrently:

hci_rx_work krfcommd

----------- ---------

rfcomm_session_get()

rfcomm_lock()

rfcomm_session_close()

rfcomm_dlc_unlink()

rfcomm_session_del()

kfree(s)

rfcomm_unlock()

walk s->dlcs

The callback can then read a freed session list head and touch freed DLCs

while updating their flags or timers.

Serialize the session lookup and DLC traversal in rfcomm_security_cfm()

with rfcomm_mutex.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References