Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex An RFCOMM connect() issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between rfcomm_mutex and hdev->lock. rfcomm_security_cfm() is called from the HCI event path, which already holds hdev->lock: hci_rx_work() hci_event_packet() hci_cc_read_enc_key_size() [hdev->lock] hci_encrypt_cfm() [hci_cb_list_lock] rfcomm_security_cfm() [rfcomm_mutex] while an RFCOMM connect() from userspace takes the same two locks the other way round: rfcomm_sock_connect() rfcomm_dlc_open() [rfcomm_mutex] __rfcomm_dlc_open() rfcomm_session_create() kernel_connect() l2cap_sock_connect() l2cap_chan_connect() [hdev->lock] WARNING: possible circular locking dependency detected kworker/u131:1/1128 is trying to acquire lock: rfcomm_mutex, at: rfcomm_security_cfm+0x31/0x3e0 [rfcomm] but task is already holding lock: hci_cb_list_lock, at: hci_cc_read_enc_key_size+0x1d2/0xcc0 Chain exists of: rfcomm_mutex --> &hdev->lock --> hci_cb_list_lock hci_auth_complete_evt() and hci_encrypt_change_evt() reach the callback the same way. Both orders have to be seen in the same boot, which is why a BR/EDR connection alone is not enough to show it: a session set up by the remote side is created by rfcomm_accept_connection() in krfcommd, which calls kernel_accept() and never takes hdev->lock under rfcomm_mutex. Connecting a device that authenticates and encrypts the link and then calling connect() on an RFCOMM socket towards any address - the connect does not have to succeed, the order is recorded before the page timeout - reports it every time. Only the session socket has to be connected with the lock held, and it does not: nothing else can see the socket before it is put on the session list. So connect it first and take rfcomm_mutex afterwards, which removes the rfcomm_mutex -> hdev->lock order for good, rather than keeping the HCI event path out of rfcomm_mutex. rfcomm_session_create() becomes rfcomm_session_connect(), which returns the connected socket without touching the session list, and rfcomm_dlc_open() adds the session once it holds the lock again. If another opener added a session for the same pair while this socket was connecting, that session is used and this socket is dropped. __rfcomm_dlc_open() now takes the session it should use, and its state check runs after the lock is re-acquired, so a DLC that was opened or closed in the meantime is still handled. Over an existing ACL link the connection can complete before the session reaches the list, and the wakeup from the socket callback is then lost, so krfcommd is woken once the session is visible. Connecting without the lock opens a window in which the socket can be closed. The DLC is not on a session yet, so rfcomm_dlc_close() finds nothing to do and returns without touching it, and rfcomm_dlc_open() would then attach a DLC whose owner is gone. rfcomm_dlc_close() now marks such a DLC with RFCOMM_CLOSED, and rfcomm_dlc_open() checks the mark once it holds rfcomm_mutex again and drops the socket instead of attaching the DLC. The mark is cleared when an open starts, so a DLC that is reused is not affected. This covers both callers of rfcomm_dlc_open(), the socket and the tty layer.

Timeline

Scores

No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.

EPSS (exploitation in 30 days)

0.18% · top 93% of all CVEs (12 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.

Affected products

• Linux · Linux

  • affected 62ce8b33eb238cf18c15207332fbdc26d858f592 – < d7a3bf6f55ab77d465206b25fe3418091c3d4b92
  • affected 3873f3449701b3dc98cba577923be6493598e7a1 – < 172b152119643018a2ed792e5096f33a4491c7de
  • affected 7ded3264106418c6456ccceaafd9fda596ce12c3 – < caf78390f78a005d5cdc1db2eb467b2794bbf020
  • affected 82425b14f0fb22e46cfddc56d6465570f5ed0ce6 – < 4dc3d5a004b8fd59f3c905631dbb18cb601b1b41
  • affected 1b7841ffad08e911e8c4b9470f3fa08423568940 – < d2206e8c78be69d21d4f5343c3e99fbaeef41cbb
  • affected 946d76db77ee5f922968ce558629ae47b381e3fc – < cc7732b8549ecb6f02457edeb8db1f6d255e381c
  • affected fbf7961964a6e93360179f64712320ae9a1e9577 – < f492de11b325446b0b11bc2eb86e1f546eaa61b6
  • affected 759c185d0bbdb131357408f50b8735e04ed3caff – < ac022970e9fb0a5f7e7d1f6c8e104c1ed924dd1c

• Linux · Linux

  • affected 5.10.270 – < 5.10.273
  • affected 5.15.221 – < 5.15.224
  • affected 6.1.188 – < 6.1.191
  • affected 6.6.157 – < 6.6.160
  • affected 6.12.109 – < 6.12.114
  • affected 6.18.50 – < 6.18.58
  • affected 7.2.4 – < 7.2.11

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-108803 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-99009](https://cveledger.app/badge/CVE-2026-99009.svg)](https://cveledger.app/cve/CVE-2026-99009)

Record last updated 30 Oct 2026, 12:40 UTC.