CVE-2026-53256 in Linux
Summary
by MITRE • 06/25/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
rfcomm_get_sock_by_channel() scans rfcomm_sk_list under the list lock, but returns the selected listener after dropping that lock without taking a reference. rfcomm_connect_ind() then locks the listener, queues a child socket on it, and may notify it after unlocking it.
The buggy scenario involves two paths, with each column showing the order within that path:
rfcomm_connect_ind(): listener close: 1. Find parent in 1. close() enters rfcomm_get_sock_by_channel() rfcomm_sock_release(). 2. Drop rfcomm_sk_list.lock 2. rfcomm_sock_shutdown() without pinning parent. closes the listener. 3. Call lock_sock(parent) and 3. rfcomm_sock_kill() bt_accept_enqueue(parent, unlinks and puts parent. sk, true). 4. Read parent flags and may 4. parent can be freed. call sk_state_change().
If close wins the race, parent can be freed before rfcomm_connect_ind() reaches lock_sock(), bt_accept_enqueue(), or the deferred-setup callback.
Take a reference on the listener before leaving rfcomm_sk_list.lock. After lock_sock() succeeds, recheck that it is still in BT_LISTEN before queueing a child, cache the deferred-setup bit while the parent is locked, and drop the reference after the last parent use.
KASAN reported a slab-use-after-free in lock_sock_nested() from rfcomm_connect_ind(), with the freeing stack going through rfcomm_sock_kill() and rfcomm_sock_release().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 06/25/2026
This vulnerability exists in the Linux kernel's Bluetooth RFCOMM implementation where a race condition can lead to use-after-free conditions during socket connection handling. The issue stems from improper reference counting and locking mechanisms when processing incoming RFCOMM connections. The rfcomm_get_sock_by_channel() function scans the rfcomm_sk_list under a list lock but returns a listener socket after dropping that lock without taking an additional reference. This creates a window where the listener socket can be closed and freed by another thread before the connecting thread completes its operation.
The problematic scenario occurs when two concurrent threads execute different code paths with specific timing requirements. In one path, rfcomm_connect_ind() calls rfcomm_get_sock_by_channel() which finds a parent listener socket but releases the list lock before pinning it. Meanwhile, in the competing path, a close operation enters rfcomm_sock_release() which calls rfcomm_sock_shutdown(), rfcomm_sock_kill(), and ultimately rfcomm_sock_kill() that unlinks and frees the parent socket. When the close operation wins this race, the parent socket gets freed before rfcomm_connect_ind() reaches lock_sock() and bt_accept_enqueue(), leading to a use-after-free condition.
This vulnerability directly maps to CWE-415: Double Free and CWE-416: Use After Free, as it involves accessing memory after it has been freed. The issue also relates to ATT&CK technique T1059.007: Command and Scripting Interpreter: Python, since such race conditions can be exploited by malicious actors to gain unauthorized access or cause system instability through crafted Bluetooth connections. The use-after-free in lock_sock_nested() reported by KASAN indicates that the kernel's memory management system detected the invalid memory access during the socket locking operation.
The fix requires implementing proper reference counting before releasing the rfcomm_sk_list.lock, ensuring that the listener socket remains valid throughout the connection process. Specifically, a reference must be taken on the listener before leaving the list lock, and after successfully acquiring the socket lock, the code must verify the socket is still in BT_LISTEN state before queuing a child socket. The deferred-setup bit should be cached while the parent socket is locked, and references should only be dropped after all parent socket usage is complete. This approach prevents the race condition by ensuring that socket operations maintain proper lifecycle management and prevents use-after-free scenarios that could lead to privilege escalation or system crashes.
The vulnerability demonstrates a classic concurrency issue in kernel networking code where improper synchronization between lock acquisition and reference counting creates exploitable conditions. The fix addresses these issues through careful locking order and reference management, ensuring that socket resources remain valid throughout the connection establishment process. This type of vulnerability is particularly dangerous because it can be triggered through normal Bluetooth operation and could potentially allow local privilege escalation or denial of service attacks against systems running affected kernel versions.