CVE-2026-89569

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. This vulnerability arises because the system does not properly manage memory when handling Bluetooth security confirmations. A race condition allows a part of the system to free memory that is still in use by another part, leading to a "use-after-free" error. This can result in a system crash, causing a Denial of Service (DoS).

Red Hat rates this vulnerability as having an Important severity impact because, although triggering the race requires adjacent Bluetooth communication or local interaction with the RFCOMM stack, the resulting use-after-free condition occurs within kernel context and can compromise kernel integrity or cause a full system crash. Standard Red Hat Enterprise Linux deployments do not enable or operate Bluetooth hardware by default, substantially reducing exposure across typical enterprise environments. Systems without physical Bluetooth adapters or where the Bluetooth subsystem is disabled are not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the kernel from loading the rfcomm module by blacklisting it, and disable the Bluetooth service if Bluetooth functionality is not needed.

1. Prevent the rfcomm module from being loaded:

echo "install rfcomm /bin/true" > /etc/modprobe.d/disable-rfcomm.conf

2. Unload the module if it is currently loaded:

modprobe -r rfcomm

3. Stop and mask the Bluetooth service:

systemctl stop bluetooth
systemctl mask bluetooth

Caveats: Disabling the rfcomm module or masking the Bluetooth service prevents Bluetooth serial communication and can disrupt Bluetooth peripherals.

Warning: If the rfcomm module is actively in use, dynamic unloading will fail, and a system reboot will be required for the changes to take effect.