# CVE-2026-98290: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup

> A race condition in Linux kernel Bluetooth RFCOMM cleanup can cause a deadlock, leading to denial of service.

- **Severity:** High 7.5 (`CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 6 Oct 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-106152, BELL-CVE-2026-98290, DEBIAN-CVE-2026-98290, GHSA-vgg6-jhr8-9c2m, UBUNTU-CVE-2026-98290

## What is CVE-2026-98290?

CVE-2026-98290 is a high-severity vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup

rfcomm_sock_cleanup_listen() closes unaccepted child sockets through
rfcomm_sock_close(), which takes the child socket lock before
rfcomm_dlc_close() acquires rfcomm_mutex. The RFCOMM worker takes these
locks in reverse order while handling connections and DLC state changes,
so lockdep reports a possible deadlock.

Close dequeued children without taking their socket lock. The accept queue
owns a reference to each child, and bt_accept_dequeue() locks the child
while unlinking it and clearing its parent pointer.

Dropping the child lock makes it important to prevent a concurrent
rfcomm_connect_ind() from enqueueing a new child after cleanup observes an
empty queue. Set a listening socket to BT_CLOSED while its lock is still
held, before dropping the lock and draining the queue. The state check in
rfcomm_connect_ind() then rejects new children once cleanup starts.

## Which versions are affected by CVE-2026-98290?


## How do I fix CVE-2026-98290?

Apply the vendor's patch.

## Is CVE-2026-98290 being exploited?

There is no known exploitation of CVE-2026-98290 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-98290 and fix it if it is affected.

What it is: CVE-2026-98290 is a high-severity vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-98290 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-98290/ (Markdown: https://insights.sbomify.com/CVE-2026-98290/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-98290
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98290
- OSV: https://osv.dev/vulnerability/CVE-2026-98290

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-98290/
Summaries are generated and may contain mistakes; the official description above is the record.