CVE-2026-98290

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcommsockcleanuplisten closes unaccepted child sockets through rfcommsockclose, which takes the child socket lock before rfcommdlcclose acquires rfcommmutex. The...

CVE-2026-98290

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcommsockcleanuplisten closes unaccepted child sockets through rfcommsockclose, which takes the child socket lock before rfcommdlcclose acquires rfcommmutex. The...

UBUNTU-CVE-2026-98290

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcommsockcleanuplisten closes unaccepted child sockets through rfcommsockclose, which takes the child socket lock before rfcommdlcclose acquires rfcommmutex. The...

EUVD-2026-93218

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcommsockcleanuplisten closes unaccepted child sockets through rfcommsockclose, which takes the child socket lock before rfcommdlcclose acquires rfcommmutex. The...

CVE-2026-98290 Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcommsockcleanuplisten closes unaccepted child sockets through rfcommsockclose, which takes the child socket lock before rfcommdlcclose acquires rfcommmutex. The...

CVE-2026-98290

The Linux kernel contains a potential deadlock in the Bluetooth RFCOMM component. Specifically, rfcomm_sock_cleanup_listen() closes unaccepted child sockets using rfcomm_sock_close(), which acquires the child socket lock before rfcomm_dlc_close() acquires the rfcomm_mutex. Because the RFCOMM work...

CVE-2026-98290

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcommsockcleanuplisten closes unaccepted child sockets through rfcommsockclose, which takes the child socket lock before rfcommdlcclose acquires rfcommmutex. The...

CVE-2026-98290 Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcommsockcleanuplisten closes unaccepted child sockets through rfcommsockclose, which takes the child socket lock before rfcommdlcclose acquires rfcommmutex. The...

CVE-2026-98290: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcommsockcleanuplisten closes unaccepted child sockets through rfcommsockclose, which takes the child socket lock before rfcommdlcclose acquires rfcommmutex. The...

Linux Distros Unpatched Vulnerability : CVE-2026-98290

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcommsockcleanuplisten closes unaccepted child sockets through rfcommsockclose, which takes...

PT-2026-106619

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A socket lock inversion exists in the Bluetooth RFCOMM component during listener cleanup. The function rfcomm sock cleanup listen closes unaccepted child sockets via rfcomm sock close,...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fixed a possible deadlock in rfcommskstatechange. syzbot reports a possible deadlock in rfcommskstatechange 1. While rfcommsockconnect acquires the sk lock and waits for the rfcomm lock, rfcommsockrelease might acquire...

SUSE CVE-2026-93783

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

CVE-2026-93783

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

DEBIAN-CVE-2026-93783

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

AZL-103928 CVE-2026-93783 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

UBUNTU-CVE-2026-93783

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

CVE-2026-93783 Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

EUVD-2026-86170

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

CVE-2026-93783

The Linux kernel contains a vulnerability in the Bluetooth RFCOMM component within the rfcomm_recv_frame() function. The root cause is a missing length validation when casting skb->data to struct rfcomm_hdr. This allows a truncated frame to trigger an out-of-bounds read of uninitialized memory...