CVE-2026-53256 - Vulnerability Details

- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

rfcomm_get_sock_by_channel() scans rfcomm_sk_list under the list lock,
but returns the selected listener after dropping that lock without
taking a reference. rfcomm_connect_ind() then locks the listener,
queues a child socket on it, and may notify it after unlocking it.

The buggy scenario involves two paths, with each column showing the
order within that path:

rfcomm_connect_ind(): listener close:
1. Find parent in 1. close() enters
rfcomm_get_sock_by_channel() rfcomm_sock_release().
2. Drop rfcomm_sk_list.lock 2. rfcomm_sock_shutdown()
without pinning parent. closes the listener.
3. Call lock_sock(parent) and 3. rfcomm_sock_kill()
bt_accept_enqueue(parent, unlinks and puts parent.
sk, true).
4. Read parent flags and may 4. parent can be freed.
call sk_state_change().

If close wins the race, parent can be freed before
rfcomm_connect_ind() reaches lock_sock(), bt_accept_enqueue(), or the
deferred-setup callback.

Take a reference on the listener before leaving rfcomm_sk_list.lock.
After lock_sock() succeeds, recheck that it is still in BT_LISTEN
before queueing a child, cache the deferred-setup bit while the parent
is locked, and drop the reference after the last parent use.

KASAN reported a slab-use-after-free in lock_sock_nested() from
rfcomm_connect_ind(), with the freeing stack going through
rfcomm_sock_kill() and rfcomm_sock_release().

Published: 2026-06-25

Score: 8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability arises from a race condition in the Linux kernel’s RFCOMM module where a listener socket can be closed and freed while an incoming connection is being processed. The result is a use‑after‑free bug that allows corrupted kernel memory access when the unavailable socket is referenced.

Affected Systems

All Linux kernel installations that contain the Bluetooth RFCOMM stack and have not yet applied the CVE-2026-53256 fix may be affected. No specific kernel version range is given, so any kernel that uses the RFCOMM listener implementation at the time the patch was merged is potentially vulnerable.

Risk and Exploitability

The CVSS score of 8 indicates a high severity for the use‑after‑free bug. The EPSS score is below 1%, suggesting that exploitation is currently expected to be rare, and the vulnerability is not yet listed in CISA’s KEV catalog. Exploitation would require an attacker able to trigger the race between opening a listener socket and peer, a scenario that is feasible over an active Bluetooth connection.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< f5ec76bdbeb80f75ad0be204371afffee0f8fac8
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a07d741c077d4e34b16458241a94d29039386553
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1f73f92f66251065a5f39b09a47cf05ea14d3107
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< de31973ef00e5aa55496f84cf6a44bb157a34e02
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< b0e33e409715c617e2a20f46f99aa5403a14dfda
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 8802413ce63175fb522a2bd609fb043a3550c720
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6f4462d12133106460d7c046b95aad2491e3fddf
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 43c441edacf953b39517a44f5e5e10a93618b226

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f5ec76bdbeb80f75ad0be204371afffee0f8fac8)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a07d741c077d4e34b16458241a94d29039386553)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1f73f92f66251065a5f39b09a47cf05ea14d3107)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,de31973ef00e5aa55496f84cf6a44bb157a34e02)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b0e33e409715c617e2a20f46f99aa5403a14dfda)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8802413ce63175fb522a2bd609fb043a3550c720)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6f4462d12133106460d7c046b95aad2491e3fddf)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,43c441edacf953b39517a44f5e5e10a93618b226)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	generic	—
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.94,6.13.0)`	unaffected	semver	—
`[7.0.13,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that implements the fix for CVE-2026-53256
If an upgrade cannot be performed immediately, disable the Bluetooth RFCOMM listener or the entire Bluetooth stack until a patched kernel is available
Keep monitoring vendor advisories and kernel changelogs for the release of the fixed patch and apply it promptly

Generated by OpenCVE AI on June 28, 2026 at 14:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00266.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1f73f92f66251065a5f39b09a47cf05ea14d3107
https://git.kernel.org/stable/c/43c441edacf953b39517a44f5e5e10a93618b226
https://git.kernel.org/stable/c/6f4462d12133106460d7c046b95aad2491e3fddf
https://git.kernel.org/stable/c/8802413ce63175fb522a2bd609fb043a3550c720
https://git.kernel.org/stable/c/a07d741c077d4e34b16458241a94d29039386553
https://git.kernel.org/stable/c/b0e33e409715c617e2a20f46f99aa5403a14dfda
https://git.kernel.org/stable/c/de31973ef00e5aa55496f84cf6a44bb157a34e02
https://git.kernel.org/stable/c/f5ec76bdbeb80f75ad0be204371afffee0f8fac8
https://lore.kernel.org/linux-cve-announce/2026062515-CVE-2026-53256-6644@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53256
https://www.cve.org/CVERecord?id=CVE-2026-53256

History

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Fri, 26 Jun 2026 04:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Fri, 26 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-364
References		https://lore.kernel.org/linux-cve-announce/2026062515-CVE-2026-53256-6644@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53256 https://www.cve.org/CVERecord?id=CVE-2026-53256
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Thu, 25 Jun 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() rfcomm_get_sock_by_channel() scans rfcomm_sk_list under the list lock, but returns the selected listener after dropping that lock without taking a reference. rfcomm_connect_ind() then locks the listener, queues a child socket on it, and may notify it after unlocking it. The buggy scenario involves two paths, with each column showing the order within that path: rfcomm_connect_ind(): listener close: 1. Find parent in 1. close() enters rfcomm_get_sock_by_channel() rfcomm_sock_release(). 2. Drop rfcomm_sk_list.lock 2. rfcomm_sock_shutdown() without pinning parent. closes the listener. 3. Call lock_sock(parent) and 3. rfcomm_sock_kill() bt_accept_enqueue(parent, unlinks and puts parent. sk, true). 4. Read parent flags and may 4. parent can be freed. call sk_state_change(). If close wins the race, parent can be freed before rfcomm_connect_ind() reaches lock_sock(), bt_accept_enqueue(), or the deferred-setup callback. Take a reference on the listener before leaving rfcomm_sk_list.lock. After lock_sock() succeeds, recheck that it is still in BT_LISTEN before queueing a child, cache the deferred-setup bit while the parent is locked, and drop the reference after the last parent use. KASAN reported a slab-use-after-free in lock_sock_nested() from rfcomm_connect_ind(), with the freeing stack going through rfcomm_sock_kill() and rfcomm_sock_release().
Title		Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1f73f92f66251065a5f39b09a47cf05ea14d3107 https://git.kernel.org/stable/c/43c441edacf953b39517a44f5e5e10a93618b226 https://git.kernel.org/stable/c/6f4462d12133106460d7c046b95aad2491e3fddf https://git.kernel.org/stable/c/8802413ce63175fb522a2bd609fb043a3550c720 https://git.kernel.org/stable/c/a07d741c077d4e34b16458241a94d29039386553 https://git.kernel.org/stable/c/b0e33e409715c617e2a20f46f99aa5403a14dfda https://git.kernel.org/stable/c/de31973ef00e5aa55496f84cf6a44bb157a34e02 https://git.kernel.org/stable/c/f5ec76bdbeb80f75ad0be204371afffee0f8fac8

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:39:46.591Z

Updated: 2026-06-28T06:41:00.818Z

Reserved: 2026-06-09T07:44:35.394Z

Link: CVE-2026-53256

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53256 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-28T14:15:08Z

Weaknesses

CWE-364
Signal Handler Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object