CVE-2026-98290 Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
A race condition in Linux kernel Bluetooth RFCOMM cleanup can cause a deadlock, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98290?
CVE-2026-98290 is a high-severity vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
rfcomm_sock_cleanup_listen() closes unaccepted child sockets through rfcomm_sock_close(), which takes the child socket lock before rfcomm_dlc_close() acquires rfcomm_mutex. The RFCOMM worker takes these locks in reverse order while handling connections and DLC state changes, so lockdep reports a possible deadlock.
Close dequeued children without taking their socket lock. The accept queue owns a reference to each child, and bt_accept_dequeue() locks the child while unlinking it and clearing its parent pointer.
Dropping the child lock makes it important to prevent a concurrent rfcomm_connect_ind() from enqueueing a new child after cleanup observes an empty queue. Set a listening socket to BT_CLOSED while its lock is still held, before dropping the lock and draining the queue. The state check in rfcomm_connect_ind() then rejects new children once cleanup starts.
Which versions are affected by CVE-2026-98290?
How do I fix CVE-2026-98290?
Apply the vendor's patch.
Is CVE-2026-98290 being exploited?
There is no known exploitation of CVE-2026-98290 in the wild and no public exploit code.
Sources
Also known as AZL-106152, BELL-CVE-2026-98290, DEBIAN-CVE-2026-98290, GHSA-vgg6-jhr8-9c2m, UBUNTU-CVE-2026-98290.