CVE-2026-80819

A flaw was found in the Bluetooth RFCOMM (Radio Frequency Communication) subsystem of the Linux kernel. A remote attacker can send a specially crafted Bluetooth Disconnect (DISC) message to a device with a deferred RFCOMM channel. This can lead to a null pointer dereference when the system attempts to process the message, resulting in a kernel crash and a denial of service.

A NULL pointer dereference in the Bluetooth RFCOMM deferred setup path occurs because rfcomm_sock_recvmsg() can call rfcomm_dlc_accept() without holding rfcomm_mutex while rfcomm_dlc_accept() immediately dereferences d session. A remote BR/EDR peer can send DISC on a deferred DLC so that the session is unlinked while RFCOMM_DEFER_SETUP remains set, and the next recvmsg() on the accepted socket dereferences a NULL session and crashes the kernel. For the CVSS the PR:N because the attacker only needs Bluetooth adjacency to the exposed RFCOMM service using BT_DEFER_SETUP and does not need a local account on the victim. The issue is adjacent network reachable rather than Internet reachable, because it requires Bluetooth radio proximity or an equivalent emulated BR/EDR link. Impact is at least denial of service via kernel crash. In the paranoid score limited confidentiality or integrity impact is kept possible because the bug is a locking and lifetime violation around a session pointer, but the patch evidence primarily supports crash impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.