CVE-2026-98455

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM CONNINFO

The RFCOMM CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled:

if (sk->sk state != BT CONNECTED &&
			!rfcomm pi(sk)->dlc->defer setup) {
	err = -ENOTCONN;
	break;
}
l2cap sk = rfcomm pi(sk)->dlc->session->sock->sk;

dlc->defer setup is set in rfcomm sock init() when rfcomm connect ind() creates a child socket for an incoming connection on a listening socket that has BT DEFER SETUP enabled. It is never cleared afterwards. The session, however, can go away underneath it.

rfcomm recv disc() forces the dlc state before tearing it down:

d->state = BT CLOSED;
 rfcomm dlc close(d, err);

The RFCOMM DEFER SETUP early return in rfcomm dlc close() only covers BT CONNECT, BT CONFIG, BT OPEN and BT CONNECT2, so with the state already BT CLOSED that switch does not match and the function falls through to rfcomm dlc unlink(), which sets d->session = NULL, while d->defer setup stays 1.

A getsockopt(SOL RFCOMM, RFCOMM CONNINFO) on the accepted socket after that point therefore skips the -ENOTCONN path -- sk->sk state is BT CLOSED, but dlc->defer setup is still set -- and dereferences the NULL session. No race is needed: once the DISC has been processed, the dereference is unconditional.

Reproduced on a KASAN kernel under QEMU with a BR/EDR peer emulated over /dev/vhci: the peer brings up an ACL link, opens L2CAP on the RFCOMM PSM, starts a session and sends SABM for a channel bound with BT DEFER SETUP, and sends DISC for that dlci after the socket has been accepted. getsockopt(SOL RFCOMM, RFCOMM CONNINFO) on the accepted socket then hits:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 1 UID: 0 PID: 150 Comm: init Tainted: G B 7.3.0-rc3-g5dd1818b15d9 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:rfcomm sock getsockopt+0x529/0x780 Call Trace: do sock getsockopt+0x3ad/0x7d0 sys getsockopt+0x10e/0x1b0 x64 sys getsockopt+0xc2/0x160 do syscall 64+0xda/0x4b0 entry SYSCALL 64 after hwframe+0x77/0x7f

0x10 is the offset of sock in struct rfcomm session; rfcomm sock getsockopt old() is inlined into rfcomm sock getsockopt().

Commit 43a556b2fd43 ("Bluetooth: RFCOMM: take rfcomm mutex for the deferred setup accept") fixed the same "a remote DISC clears the session while deferred setup is still flagged" problem in rfcomm dlc accept(); this is the remaining instance of it, in the getsockopt path.

Deferred setup only leaves a socket usable here once it has reached BT CONNECT2, so restrict the exception to that state and check that a session is actually present before following it.