CVE-2026-98455

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

The RFCOMM_CONNINFO getsockopt handler accepts a socket that is not

connected as long as deferred setup is enabled:

if (sk->sk_state != BT_CONNECTED &&

!rfcomm_pi(sk)->dlc->defer_setup) {

err = -ENOTCONN;

break;

}

l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;

dlc->defer_setup is set in rfcomm_sock_init() when rfcomm_connect_ind()

creates a child socket for an incoming connection on a listening socket

that has BT_DEFER_SETUP enabled. It is never cleared afterwards. The

session, however, can go away underneath it.

rfcomm_recv_disc() forces the dlc state before tearing it down:

d->state = BT_CLOSED;

__rfcomm_dlc_close(d, err);

The RFCOMM_DEFER_SETUP early return in __rfcomm_dlc_close() only covers

BT_CONNECT, BT_CONFIG, BT_OPEN and BT_CONNECT2, so with the state

already BT_CLOSED that switch does not match and the function f

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References