CVE-2026-98455

A flaw was found in the Linux kernel's Bluetooth Radio Frequency Communication (RFCOMM) subsystem. This vulnerability allows a local user to cause a Denial of Service (DoS) by crashing the system. By querying connection options on a socket whose connection was disconnected while deferred setup remained active, the kernel improperly accesses a cleared session pointer, triggering a NULL pointer dereference.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation is restricted to a local denial of service (kernel crash) without compromising system confidentiality or integrity. In typical enterprise server deployments, Bluetooth interfaces and RFCOMM services are rarely enabled or connected, substantially minimizing exposure. Triggering the flaw requires a local user to manipulate an RFCOMM socket configured with deferred setup and issue a connection info request after the session has been closed by a remote peer.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.