Към съдържанието
Търсене

CVE-2026-98455: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO The RFCOMM_CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if (sk->sk_state != BT_CONNECTED && !rfcomm_pi(sk)->dlc->defer_setup) { err = -ENOTCONN; break; } l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk; dlc->defer_setup is set in rfcomm_sock_init() when rfcomm_connect_ind() creates a child socket for an incoming connection on a listening socket that has BT_DEFER_SETUP enabled. It is never cleared afterwards. The session, however, can go away underneath it. rfcomm_recv_disc() forces the dlc state before tearing it down: d->state = BT_CLOSED; __rfcomm_dlc_close(d, err); The RFCOMM_DEFER_SETUP early return in __rfcomm_dlc_close() only covers BT_CONNECT, BT_CONFIG, BT_OPEN and BT_CONNECT2, so with the state already BT_CLOSED that switch does not match and the function falls through to rfcomm_dlc_unlink(), which sets d->session = NULL, while d->defer_setup stays 1. A getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted socket after that point therefore skips the -ENOTCONN path -- sk->sk_state is BT_CLOSED, but dlc->defer_setup is still set -- and dereferences the NULL session. No race is needed: once the DISC has been processed, the dereference is unconditional. Reproduced on a KASAN kernel under QEMU with a BR/EDR peer emulated over /dev/vhci: the peer brings up an ACL link, opens L2CAP on the RFCOMM PSM, starts a session and sends SABM for a channel bound with BT_DEFER_SETUP, and sends DISC for that dlci after the socket has been accepted. getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted socket then hits: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 1 UID: 0 PID: 150 Comm: init Tainted: G B 7.

    Засегнати продукти

    • Linux Linux: bb23c0ab824653be4aa7dfca15b07b3059717004 преди c3aee3fc1287c8a555baf3895959087cb0c33fe8; bb23c0ab824653be4aa7dfca15b07b3059717004 преди 4bf5ca47203049ce3648f750a53dcdc98bcc9e3e; bb23c0ab824653be4aa7dfca15b07b3059717004 преди 1c4f7e1177da2f229be04139c27e5370a1cfba52; bb23c0ab824653be4aa7dfca15b07b3059717004 преди 84ae3cfd7d3a63591a2eb4faa24faf678c6708aa; bb23c0ab824653be4aa7dfca15b07b3059717004 преди c7362f6a18ed167f52f08ce25eeec8a7818c5004; bb23c0ab824653be4aa7dfca15b07b3059717004 преди 8f5b30cc12c409ff62891e47ed51e6bf0945a3ea; bb23c0ab824653be4aa7dfca15b07b3059717004 преди 005b23d9e324fe5d0acbcfa70c625f2e81189046; bb23c0ab824653be4aa7dfca15b07b3059717004 преди 46f8ffd0a1f1eb6cbc94946a92c11ef601e228a1
    • Linux Linux: 2.6.30; преди 2.6.30; 5.10.271 до 5.10.*; 5.15.222 до 5.15.*; 6.1.189 до 6.1.*; 6.6.158 до 6.6.*; 6.12.112 до 6.12.*; 6.18.55 до 6.18.*; 7.2.9 до 7.2.*; от 7.3 нататък

    История

    • 18 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-98455: Linux | freedomonline.bg