The Linux kernel’s RFCOMM stack can dereference a NULL session pointer when handling a deferred channel accept without holding the necessary rfcomm_mutex lock. A remote Bluetooth device that sends a DISC command after establishing a link with deferred setup causes the session to be cleared, the flag to remain set, and the next recvmsg operation to dereference the now‑NULL session. This results in a general protection fault and a KASAN NULL‑pointer dereference, leading to a kernel crash and loss of availability for the affected system.

All Linux kernel implementations that include the identified RFCOMM code and have not incorporated the patch. No specific affected version numbers are listed, but any distribution shipping the unpatched kernel is at risk. The flaw resides in the kernel’s Bluetooth RFCOMM subsystem, so any system with Bluetooth enabled and the RFCOMM stack compiled is potentially vulnerable.

The fault triggers a kernel crash, yielding a denial‑of‑service condition; it does not provide code execution or privilege escalation on its own. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, implying no known public exploits. The likely attack vector is a remote Bluetooth device that can communicate via RFCOMM and send a DISC on a channel set for deferred setup. While no timing window is required, the exploitation requires the attacker to be able to establish a Bluetooth connection, which is usually limited to devices in proximity or within a trusted network. The impact on availability is high if the vulnerability is triggered, but the overall likelihood depends on the exposure of the Bluetooth interface.