---
id: CVE-2026-98739
title: 'Bluetooth: RFCOMM: Fix initial port reference race'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: RFCOMM: Fix initial port reference race

  For RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and
  __rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decid…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa <
    cd247e38b14df48d6b3940c4573a9f7acb10c363
  - >-
    Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa <
    d3dd18e85c140df72e0f2b5ee156ebfba04c06cb
  - >-
    Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa <
    c50360a019766fafa27318928bfea96dcce8a37d
  - >-
    Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa <
    55d162aa00d1ee33c3e6fa88b71f1e2d6e1441e9
  - >-
    Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa <
    a03ccf1ab77380d4c4a3c56552e12de4a83efa21
  - >-
    Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa <
    0a554901bd227537f79220443b2b36d585d62893
  - >-
    Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa <
    e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b
  - >-
    Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa <
    2d696c1ed3468dcb62578a3911e687110d463520
  - Linux 3.15
published: '2026-10-18'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:39:14.099Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98739'
references:
  - url: 'https://git.kernel.org/stable/c/cd247e38b14df48d6b3940c4573a9f7acb10c363'
  - url: 'https://git.kernel.org/stable/c/d3dd18e85c140df72e0f2b5ee156ebfba04c06cb'
  - url: 'https://git.kernel.org/stable/c/c50360a019766fafa27318928bfea96dcce8a37d'
  - url: 'https://git.kernel.org/stable/c/55d162aa00d1ee33c3e6fa88b71f1e2d6e1441e9'
  - url: 'https://git.kernel.org/stable/c/a03ccf1ab77380d4c4a3c56552e12de4a83efa21'
  - url: 'https://git.kernel.org/stable/c/0a554901bd227537f79220443b2b36d585d62893'
  - url: 'https://git.kernel.org/stable/c/e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b'
  - url: 'https://git.kernel.org/stable/c/2d696c1ed3468dcb62578a3911e687110d463520'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98739.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98739'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555051'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98739'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98739'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98739.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00176
epssPercentile: 0.07213
ingestedAt: '2026-10-18T16:47:32.504Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Fix initial port reference race

For RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and
__rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the
initial tty_port reference. The release path tests the bit separately
from the install path setting it, so both can drop that reference.

The synchronous hangup does not prevent this race: port->tty is not
assigned until tty_port_open(), after installation. The following
interleaving is possible:

  1. Install and release each obtain a reference with rfcomm_dev_get().
  2. Release observes RFCOMM_TTY_OWNED clear.
  3. Install sets RFCOMM_TTY_OWNED and drops the initial reference.
  4. Release drops the same initial reference again.
  5. TTY cleanup drops its reference and frees the device.
  6. Release performs its final tty_port_put() on the freed port.

KASAN reported:

  BUG: KASAN: slab-use-after-free in tty_port_put+0x22/0x190
  Write of size 4 at addr ffff8881001d3d5c by task poc/92

  Call Trace:
   tty_port_put+0x22/0x190
   rfcomm_dev_ioctl+0x1d4/0x1930
   sock_do_ioctl+0x110/0x260
   sock_ioctl+0x380/0x590
   __x64_sys_ioctl+0x134/0x1c0

  Allocated by task 88:
   rfcomm_dev_ioctl+0x8f6/0x1930
   sock_do_ioctl+0x110/0x260
   sock_ioctl+0x380/0x590
   __x64_sys_ioctl+0x134/0x1c0

  Freed by task 65:
   kfree+0x131/0x3c0
   rfcomm_dev_destruct+0x23b/0x2f0
   release_one_tty+0xc1/0x370
   process_one_work+0x661/0x1090

Use test_and_set_bit() in both paths so that only the caller that changes
RFCOMM_TTY_OWNED from clear to set drops the initial reference. Each path
keeps its own lookup reference until release or TTY cleanup, preserving
the existing callback ordering and error handling.

## Affected

- `Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa < cd247e38b14df48d6b3940c4573a9f7acb10c363`
- `Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa < d3dd18e85c140df72e0f2b5ee156ebfba04c06cb`
- `Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa < c50360a019766fafa27318928bfea96dcce8a37d`
- `Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa < 55d162aa00d1ee33c3e6fa88b71f1e2d6e1441e9`
- `Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa < a03ccf1ab77380d4c4a3c56552e12de4a83efa21`
- `Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa < 0a554901bd227537f79220443b2b36d585d62893`
- `Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa < e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b`
- `Linux >= 80ea73378af46b0023eb2f400d26c2a60248ffaa < 2d696c1ed3468dcb62578a3911e687110d463520`
- `Linux 3.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98739.json)