Към съдържанието
Търсене

CVE-2026-99009: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex An RFCOMM connect() issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between rfcomm_mutex and hdev->lock. rfcomm_security_cfm() is called from the HCI event path, which already holds hdev->lock: hci_rx_work() hci_event_packet() hci_cc_read_enc_key_size() [hdev->lock] hci_encrypt_cfm() [hci_cb_list_lock] rfcomm_security_cfm() [rfcomm_mutex] while an RFCOMM connect() from userspace takes the same two locks the other way round: rfcomm_sock_connect() rfcomm_dlc_open() [rfcomm_mutex] __rfcomm_dlc_open() rfcomm_session_create() kernel_connect() l2cap_sock_connect() l2cap_chan_connect() [hdev->lock] WARNING: possible circular locking dependency detected kworker/u131:1/1128 is trying to acquire lock: rfcomm_mutex, at: rfcomm_security_cfm+0x31/0x3e0 [rfcomm] but task is already holding lock: hci_cb_list_lock, at: hci_cc_read_enc_key_size+0x1d2/0xcc0 Chain exists of: rfcomm_mutex --> &hdev->lock --> hci_cb_list_lock hci_auth_complete_evt() and hci_encrypt_change_evt() reach the callback the same way. Both orders have to be seen in the same boot, which is why a BR/EDR connection alone is not enough to show it: a session set up by the remote side is created by rfcomm_accept_connection() in krfcommd, which calls kernel_accept() and never takes hdev->lock under rfcomm_mutex. Connecting a device that authenticates and encrypts the link and then calling connect() on an RFCOMM socket towards any address - the connect does not have to succeed, the order is recorded before the page timeout - reports it every time. Only the session socket has to be connected with the lock held, and it does not: nothing else can see the socket before i

    Засегнати продукти

    • Linux Linux: 62ce8b33eb238cf18c15207332fbdc26d858f592 преди d7a3bf6f55ab77d465206b25fe3418091c3d4b92; 3873f3449701b3dc98cba577923be6493598e7a1 преди 172b152119643018a2ed792e5096f33a4491c7de; 7ded3264106418c6456ccceaafd9fda596ce12c3 преди caf78390f78a005d5cdc1db2eb467b2794bbf020; 82425b14f0fb22e46cfddc56d6465570f5ed0ce6 преди 4dc3d5a004b8fd59f3c905631dbb18cb601b1b41; 1b7841ffad08e911e8c4b9470f3fa08423568940 преди d2206e8c78be69d21d4f5343c3e99fbaeef41cbb; 946d76db77ee5f922968ce558629ae47b381e3fc преди cc7732b8549ecb6f02457edeb8db1f6d255e381c; fbf7961964a6e93360179f64712320ae9a1e9577 преди f492de11b325446b0b11bc2eb86e1f546eaa61b6; 759c185d0bbdb131357408f50b8735e04ed3caff преди ac022970e9fb0a5f7e7d1f6c8e104c1ed924dd1c
    • Linux Linux: 5.10.270 преди 5.10.273; 5.15.221 преди 5.15.224; 6.1.188 преди 6.1.191; 6.6.157 преди 6.6.160; 6.12.109 преди 6.12.114; 6.18.50 преди 6.18.58; 7.2.4 преди 7.2.11

    История

    • 23 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-99009: Linux | freedomonline.bg