{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.190-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO  The RFCOMM_CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled:  \tif (sk-\u003esk_state != BT_CONNECTED \u0026\u0026 \t\t\t\t!rfcomm_pi(sk)-\u003edlc-\u003edefer_setup) { \t\terr = -ENOTCONN; \t\tbreak; \t} \tl2cap_sk = rfcomm_pi(sk)-\u003edlc-\u003esession-\u003esock-\u003esk;  dlc-\u003edefer_setup is set in rfcomm_sock_init() when rfcomm_connect_ind() creates a child socket for an incoming connection on a listening socket that has BT_DEFER_SETUP enabled. It is never cleared afterwards. The session, however, can go away underneath it.  rfcomm_recv_disc() forces the dlc state before tearing it down:  \td-\u003estate = BT_CLOSED; \t__rfcomm_dlc_close(d, err);  The RFCOMM_DEFER_SETUP early return in __rfcomm_dlc_close() only covers BT_CONNECT, BT_CONFIG, BT_OPEN and BT_CONNECT2, so with the state already BT_CLOSED that switch does not match and the function falls through to rfcomm_dlc_unlink(), which sets d-\u003esession = NULL, while d-\u003edefer_setup stays 1.  A getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted socket after that point therefore skips the -ENOTCONN path -- sk-\u003esk_state is BT_CLOSED, but dlc-\u003edefer_setup is still set -- and dereferences the NULL session. No race is needed: once the DISC has been processed, the dereference is unconditional.  Reproduced on a KASAN kernel under QEMU with a BR/EDR peer emulated over /dev/vhci: the peer brings up an ACL link, opens L2CAP on the RFCOMM PSM, starts a session and sends SABM for a channel bound with BT_DEFER_SETUP, and sends DISC for that dlci after the socket has been accepted. getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted socket then hits:   Oops: general protection fault, probably for non-canonical address  0xdffffc0000000002: 0000 [#1] SMP KASAN PTI  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]  CPU: 1 UID: 0 PID: 150 Comm: init Tainted: G B 7.3.0-rc3-g5dd1818b15d9  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)  RIP: 0010:rfcomm_sock_getsockopt+0x529/0x780  Call Trace:   \u003cTASK\u003e   do_sock_getsockopt+0x3ad/0x7d0   __sys_getsockopt+0x10e/0x1b0   __x64_sys_getsockopt+0xc2/0x160   do_syscall_64+0xda/0x4b0   entry_SYSCALL_64_after_hwframe+0x77/0x7f   \u003c/TASK\u003e  0x10 is the offset of sock in struct rfcomm_session; rfcomm_sock_getsockopt_old() is inlined into rfcomm_sock_getsockopt().  Commit 43a556b2fd43 (\"Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept\") fixed the same \"a remote DISC clears the session while deferred setup is still flagged\" problem in rfcomm_dlc_accept(); this is the remaining instance of it, in the getsockopt path.  Deferred setup only leaves a socket usable here once it has reached BT_CONNECT2, so restrict the exception to that state and check that a session is actually present before following it.",
  "id": "DEBIAN-CVE-2026-98455",
  "modified": "2026-10-19T04:47:32.687856873Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98455"
    }
  ],
  "upstream": [
    "CVE-2026-98455"
  ]
}