Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcomm_sock_cleanup_listen() closes unaccepted child sockets through rfcomm_sock_close(), which takes the child socket lock before rfcomm_dlc_close() acquires rfcomm_mutex. The RFCOMM worker takes these locks in reverse order while handling connections and DLC state changes, so lockdep reports a possible deadlock. Close dequeued children without taking their socket lock. The accept queue owns a reference to each child, and bt_accept_dequeue() locks the child while unlinking it and clearing its parent pointer. Dropping the child lock makes it important to prevent a concurrent rfcomm_connect_ind() from enqueueing a new child after cleanup observes an empty queue. Set a listening socket to BT_CLOSED while its lock is still held, before dropping the lock and draining the queue. The state check in rfcomm_connect_ind() then rejects new children once cleanup starts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-06T09:18:19.317Z",
  "pubdate": "2026-10-06T09:18:19.317Z",
  "executiveSummary": "A lock inversion vulnerability exists in the Linux kernel's Bluetooth RFCOMM implementation within the rfcomm_sock_cleanup_listen() function.\nThis flaw involves inconsistent locking order between the socket lock and the rfcomm_mutex, which can lead to a deadlock scenario during the cleanup of unaccepted child sockets.\nThe vulnerability affects the Linux kernel Bluetooth subsystem. It poses a risk of local denial-of-service (DoS) as the kernel can hang if the race condition is triggered.\nAn attacker capable of initiating and rapidly terminating Bluetooth RFCOMM connections could potentially induce the deadlock, leading to system instability.\nThe issue arises from the way listening sockets handle the lifecycle of child sockets, specifically during the cleanup phase where internal kernel locking mechanisms conflict with concurrent connection handling tasks.",
  "technicalDetails": "The root cause of this vulnerability is a lock inversion occurring between the child socket lock and the rfcomm_mutex. Specifically, rfcomm_sock_cleanup_listen() triggers rfcomm_sock_close() to handle unaccepted child sockets. In the original implementation, rfcomm_sock_close() attempted to acquire the child socket lock before subsequently invoking rfcomm_dlc_close(), which requires the global rfcomm_mutex.\nThe RFCOMM worker thread, which handles asynchronous connection state transitions and DLC state updates, acquires these locks in the opposite order (rfcomm_mutex first, followed by the socket lock). This discrepancy triggers a circular dependency, which is flagged by lockdep as a potential deadlock condition. When a thread holding the socket lock attempts to acquire the mutex while another thread holding the mutex attempts to acquire the socket lock, the system stalls.\nTo exploit this, an attacker must interact with the Bluetooth stack to force the kernel into a state where a listening socket is being cleaned up while an RFCOMM worker is processing DLC state changes. By initiating multiple connections that are then abruptly terminated, an attacker can maximize the probability of triggering the race condition.\nThe remediation involves modifying the cleanup logic to avoid holding the socket lock while performing operations that require the rfcomm_mutex. By setting the listening socket state to BT_CLOSED while holding the socket lock, the kernel effectively blocks further calls to rfcomm_connect_ind(), which would otherwise attempt to enqueue new child sockets. Once the state is locked, the cleanup routine can proceed to drain the accept queue by dequeuing children without needing to hold individual child socket locks, thus breaking the circular dependency chain and ensuring that the lock acquisition order remains consistent across all execution paths within the RFCOMM subsystem."
}