CVE-2026-98290

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup

rfcomm_sock_cleanup_listen() closes unaccepted child sockets through

rfcomm_sock_close(), which takes the child socket lock before

rfcomm_dlc_close() acquires rfcomm_mutex. The RFCOMM worker takes these

locks in reverse order while handling connections and DLC state changes,

so lockdep reports a possible deadlock.

Close dequeued children without taking their socket lock. The accept queue

owns a reference to each child, and bt_accept_dequeue() locks the child

while unlinking it and clearing its parent pointer.

Dropping the child lock makes it important to prevent a concurrent

rfcomm_connect_ind() from enqueueing a new child after cleanup observes an

empty queue. Set a listening socket to BT_CLOSED while its lock is still

held, before dropping the lock and draining the queue. The state check in

rfcomm_connect_ind() then rejects new children once clean

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References