CVE-2026-53256

A flaw was found in the Linux kernel's Bluetooth RFCOMM (Radio Frequency Communication) subsystem. A race condition in the rfcomm_connect_ind() function, specifically during the handling of listener sockets, can lead to a use-after-free vulnerability. A local attacker could exploit this to cause a denial of service or potentially achieve arbitrary code execution.

A race in Bluetooth RFCOMM can leave rfcomm_connect_ind using a listener socket after it was closed and freed by another path. The selected listener was returned after dropping rfcomm_sk_list.lock without holding a reference, so close can unlink and free the parent before lock_sock, bt_accept_enqueue, or the deferred setup callback uses it. KASAN reported a slab use after free in lock_sock_nested, which makes this a memory safety issue rather than a pure DoS only bug. For the CVSS the PR:N is used for the paranoid score because an adjacent Bluetooth peer may trigger connection indications without local privileges on the victim, assuming a reachable RFCOMM listener and suitable Bluetooth access. The issue is not Internet reachable and should be treated as AV:A because exploitation requires Bluetooth proximity or access to the local Bluetooth network.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.