CVE-2026-53256 Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
A race condition in the Linux kernel Bluetooth RFCOMM module allows a use-after-free, potentially enabling local attackers to execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53256?
CVE-2026-53256 is a high-severity use after free vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
rfcomm_get_sock_by_channel() scans rfcomm_sk_list under the list lock, but returns the selected listener after dropping that lock without taking a reference. rfcomm_connect_ind() then locks the listener, queues a child socket on it, and may notify it after unlocking it.
The buggy scenario involves two paths, with each column showing the order within that path:
rfcomm_connect_ind(): listener close: 1. Find parent in 1. close() enters rfcomm_get_sock_by_channel() rfcomm_sock_release(). 2. Drop rfcomm_sk_list.lock 2. rfcomm_sock_shutdown() without pinning parent. closes the listener. 3. Call lock_sock(parent) and 3. rfcomm_sock_kill() bt_accept_enqueue(parent, unlinks and puts parent. sk, true). 4. Read parent flags and may 4. parent can be freed. call sk_state_change().
If close wins the race, parent can be freed before rfcomm_connect_ind() reaches lock_sock(), bt_accept_enqueue(), or the deferred-setup callback.
Take a reference on the listener before leaving rfcomm_sk_list.lock. After lock_sock() succeeds, recheck that it is still in BT_LISTEN before queueing a child, cache the deferred-setup bit while the parent is locked, and drop the reference after the last parent use.
KASAN reported a slab-use-after-free in lock_sock_nested() from rfcomm_connect_ind(), with the freeing stack going through rfcomm_sock_kill() and rfcomm_sock_release().
Weakness: CWE-416
Which versions are affected by CVE-2026-53256?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53256?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-53256 being exploited?
There is no known exploitation of CVE-2026-53256 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90851, BELL-CVE-2026-53256, DEBIAN-CVE-2026-53256, GHSA-hq32-rppj-r4rv, ROOT-OS-DEBIAN-11-CVE-2026-53256, ROOT-OS-DEBIAN-12-CVE-2026-53256 and 3 more.