PT-2026-116958 · Linux · Linux
CVE-2026-98739
·
تاريخ النشر
2026-10-18
·
تاريخ التحديث
2026-10-18
لا يوجد
لا تتوفر حاليًا تقييمات أو مقاييس للخطورة. سنحدّث المعلومات المقابلة في الصفحة فور توفرها.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: Fix initial port reference race
For RFCOMM RELEASE ONHUP devices, rfcomm tty install() and
rfcomm release dev() both use RFCOMM TTY OWNED to decide who drops the
initial tty port reference. The release path tests the bit separately
from the install path setting it, so both can drop that reference.
The synchronous hangup does not prevent this race: port->tty is not
assigned until tty port open(), after installation. The following
interleaving is possible:
- Install and release each obtain a reference with rfcomm dev get().
- Release observes RFCOMM TTY OWNED clear.
- Install sets RFCOMM TTY OWNED and drops the initial reference.
- Release drops the same initial reference again.
- TTY cleanup drops its reference and frees the device.
- Release performs its final tty port put() on the freed port.
KASAN reported:
BUG: KASAN: slab-use-after-free in tty port put+0x22/0x190
Write of size 4 at addr ffff8881001d3d5c by task poc/92
Call Trace:
tty port put+0x22/0x190
rfcomm dev ioctl+0x1d4/0x1930
sock do ioctl+0x110/0x260
sock ioctl+0x380/0x590
x64 sys ioctl+0x134/0x1c0
Allocated by task 88:
rfcomm dev ioctl+0x8f6/0x1930
sock do ioctl+0x110/0x260
sock ioctl+0x380/0x590
x64 sys ioctl+0x134/0x1c0
Freed by task 65:
kfree+0x131/0x3c0
rfcomm dev destruct+0x23b/0x2f0
release one tty+0xc1/0x370
process one work+0x661/0x1090
Use test and set bit() in both paths so that only the caller that changes
RFCOMM TTY OWNED from clear to set drops the initial reference. Each path
keeps its own lookup reference until release or TTY cleanup, preserving
the existing callback ordering and error handling.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
المعرّفات ذات الصلة
المنتجات المتأثرة
Linux