CVE-2026-89569 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Bluetooth RFCOMM implementation users, and Linux distribution maintainers should assess exposure and verify that their systems are not vulnerable.

Why it matters

This vulnerability requires verification from official sources to determine affected versions, exploitation, impact, and remediation. Defenders should prioritize verifying Linux kernel versions, monitoring system logs, and applying patches as they become available.

• Potential system crashes or instability due to use-after-free vulnerability.
• Possible elevation of privileges or unauthorized access via Bluetooth RFCOMM.

Technical summary

The rfcomm_security_cfm function in the Linux kernel's Bluetooth RFCOMM implementation does not hold the rfcomm_mutex while looking up a session on session_list and walking its DLC list. This allows for concurrent teardown and freeing of the session and DLCs by krfcommd, resulting in a use-after-free vulnerability. The vulnerability was reported by KASAN, which detected a slab-use-after-free in rfcomm_security_cfm+0x41c/0x440. The issue was resolved by serializing the session lookup and DLC traversal in rfcomm_security_cfm with rfcomm_mutex. This change ensures that the session and DLCs are not torn down while the callback is using them, preventing potential system crashes or instability and possible elevation

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to ensure the vulnerability is addressed.
• Verify that the Linux kernel version in use is not vulnerable.
• Monitor system logs for potential exploitation attempts.
• Perform a thorough review of system configurations and ensure that Bluetooth RFCOMM is properly secured.
• Check for any existing compensating controls that may mitigate the vulnerability.
• Inventory all assets that may be affected by this vulnerability and prioritize remediation efforts.
• Track and monitor remediation efforts to ensure timely resolution.

Evidence notes

The vulnerability was reported by KASAN, which detected a slab-use-after-free in rfcomm_security_cfm+0x41c/0x440. The issue was resolved by serializing the session lookup and DLC traversal in rfcomm_security_cfm with rfcomm_mutex.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.