CVE-2026-68188

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: RFCOMM: Fix session UAF in set_termios<br /> <br /> rfcomm_tty_set_termios() tests dlc-&gt;session without rfcomm_mutex and<br /> later passes the pointer to rfcomm_send_rpn(). The latter dereferences<br /> both session-&gt;initiator and session-&gt;sock. Meanwhile, krfcommd can<br /> unlink the DLC and free the session while holding rfcomm_mutex.<br /> <br /> The race can proceed as follows:<br /> <br /> TTY ioctl task krfcommd<br /> -------------- --------<br /> load dlc-&gt;session<br /> enter rfcomm_send_rpn()<br /> lock rfcomm_mutex<br /> clear dlc-&gt;session<br /> free session<br /> unlock rfcomm_mutex<br /> read session-&gt;initiator<br /> <br /> KASAN reported:<br /> <br /> BUG: KASAN: slab-use-after-free in rfcomm_send_rpn+0x297/0x2a0<br /> Read of size 4 at addr ffff88810012a850 by task poc/92<br /> <br /> Call Trace:<br /> rfcomm_send_rpn+0x297/0x2a0<br /> rfcomm_tty_set_termios+0x50d/0x850<br /> tty_set_termios+0x596/0x950<br /> set_termios+0x46a/0x6e0<br /> tty_mode_ioctl+0x152/0xbd0<br /> tty_ioctl+0x915/0x1240<br /> __x64_sys_ioctl+0x134/0x1c0<br /> <br /> Allocated by task 92:<br /> rfcomm_session_add+0x9e/0x2e0<br /> rfcomm_dlc_open+0x8b1/0xe00<br /> rfcomm_dev_activate+0x85/0x1a0<br /> rfcomm_tty_open+0x90/0x280<br /> <br /> Freed by task 68:<br /> kfree+0x131/0x3c0<br /> rfcomm_session_del+0x119/0x180<br /> rfcomm_run+0x737/0x4710<br /> <br /> Add rfcomm_dlc_send_rpn(), which holds rfcomm_mutex while it verifies<br /> that the DLC is still attached and sends the RPN frame. Have the TTY<br /> path use the helper and drop its unlocked session check. This keeps the<br /> session valid through both the frame construction and socket send.