CVE-2026-89569

The Linux kernel's Bluetooth RFCOMM subsystem contains a use-after-free in rfcomm_security_cfm(), which looks up an RFCOMM session and walks its data-link connection (DLC) list without holding rfcomm_mutex. A remote Bluetooth peer within radio range can trigger the flaw by racing a security/encryption confirmation event (processed in hci_rx_work) against RFCOMM session teardown by the krfcommd worker thread, causing the callback to read a freed session and touch freed DLC structures while updating flags or timers. Successful exploitation of this kernel memory corruption can yield high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.8, adjacent-network vector over Bluetooth), including kernel crashes or potential privilege escalation to ring 0. Any device running an affected kernel with Bluetooth Classic (RFCOMM) enabled is in scope, including Linux laptops, embedded, and IoT systems. No public proof-of-concept exists and the issue is not in CISA's KEV catalog, so exploitation is currently considered theoretical.

What to do: Apply kernel updates as soon as your distribution ships a build containing this RFCOMM fix and reboot into the patched kernel. If patching is not immediately possible, mitigate by disabling Bluetooth Classic where it is not required (e.g., blacklisting the rfcomm module, powering off or physically removing Bluetooth adapters, or blocking Bluetooth in BIOS/firmware). Audit logs for kASAN slab-use-after-free reports referencing rfcomm_security_cfm or unexpected kernel panics near Bluetooth activity, and prioritize patching devices in Bluetooth-reachable locations such as laptops and kiosks in public or shared spaces.