CVE-2026-98739
Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.17 %mayor que el 6 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
Bluetooth: RFCOMM: Fix initial port reference race
Para los dispositivos RFCOMM_RELEASE_ONHUP, rfcomm_tty_install() y __rfcomm_release_dev() usan ambos RFCOMM_TTY_OWNED para decidir quién libera la referencia inicial de tty_port. La ruta de liberación comprueba el bit por separado de la ruta de instalación que lo establece, por lo que ambas pueden liberar esa referencia.
El cuelgue síncrono (hangup) no impide esta condición de carrera: port->tty no se asigna hasta tty_port_open(), después de la instalación. Es posible la siguiente intercalación:
Leer descripción completaMostrar menos
Usar test_and_set_bit() en ambas rutas para que solo el llamador que cambie RFCOMM_TTY_OWNED de cero a uno libere la referencia inicial. Cada ruta conserva su propia referencia de búsqueda hasta la liberación o la limpieza de TTY, manteniendo el orden existente de los callbacks y el tratamiento de errores.
Detalles técnicos trazas, registros y código del informe original
1. Install y release obtienen cada una una referencia con rfcomm_dev_get(). 2. Release observa que RFCOMM_TTY_OWNED está a cero. 3. Install establece RFCOMM_TTY_OWNED y libera la referencia inicial. 4. Release libera de nuevo la misma referencia inicial. 5. La limpieza de TTY libera su referencia y libera el dispositivo. 6. Release realiza su tty_port_put() final sobre el puerto ya liberado. KASAN informó: BUG: KASAN: slab-use-after-free in tty_port_put+0x22/0x190 Write of size 4 at addr ffff8881001d3d5c by task poc/92 Call Trace: tty_port_put+0x22/0x190 rfcomm_dev_ioctl+0x1d4/0x1930 sock_do_ioctl+0x110/0x260 sock_ioctl+0x380/0x590 __x64_sys_ioctl+0x134/0x1c0 Allocated by task 88: rfcomm_dev_ioctl+0x8f6/0x1930 sock_do_ioctl+0x110/0x260 sock_ioctl+0x380/0x590 __x64_sys_ioctl+0x134/0x1c0 Freed by task 65: kfree+0x131/0x3c0 rfcomm_dev_destruct+0x23b/0x2f0 release_one_tty+0xc1/0x370 process_one_work+0x661/0x1090
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.17 %
- Percentil entre todas las CVEs puntuadas
- 6
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 4 referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98739",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "80ea73378af46b0023eb2f400d26c2a60248ffaa",
"lessThan": "a03ccf1ab77380d4c4a3c56552e12de4a83efa21",
"versionType": "git"
},
{
"status": "affected",
"version": "80ea73378af46b0023eb2f400d26c2a60248ffaa",
"lessThan": "0a554901bd227537f79220443b2b36d585d62893",
"versionType": "git"
},
{
"status": "affected",
"version": "80ea73378af46b0023eb2f400d26c2a60248ffaa",
"lessThan": "e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b",
"versionType": "git"
},
{
"status": "affected",
"version": "80ea73378af46b0023eb2f400d26c2a60248ffaa",
"lessThan": "2d696c1ed3468dcb62578a3911e687110d463520",
"versionType": "git"
}
],
"programFiles": [
"net/bluetooth/rfcomm/tty.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/bluetooth/rfcomm/tty.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:27.590",
"references": [
{
"url": "https://git.kernel.org/stable/c/0a554901bd227537f79220443b2b36d585d62893",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2d696c1ed3468dcb62578a3911e687110d463520",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a03ccf1ab77380d4c4a3c56552e12de4a83efa21",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fix initial port reference race\n\nFor RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and\n__rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the\ninitial tty_port reference. The release path tests the bit separately\nfrom the install path setting it, so both can drop that reference.\n\nThe synchronous hangup does not prevent this race: port->tty is not\nassigned until tty_port_open(), after installation. The following\ninterleaving is possible:\n\n 1. Install and release each obtain a reference with rfcomm_dev_get().\n 2. Release observes RFCOMM_TTY_OWNED clear.\n 3. Install sets RFCOMM_TTY_OWNED and drops the initial reference.\n 4. Release drops the same initial reference again.\n 5. TTY cleanup drops its reference and frees the device.\n 6. Release performs its final tty_port_put() on the freed port.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in tty_port_put+0x22/0x190\n Write of size 4 at addr ffff8881001d3d5c by task poc/92\n\n Call Trace:\n tty_port_put+0x22/0x190\n rfcomm_dev_ioctl+0x1d4/0x1930\n sock_do_ioctl+0x110/0x260\n sock_ioctl+0x380/0x590\n __x64_sys_ioctl+0x134/0x1c0\n\n Allocated by task 88:\n rfcomm_dev_ioctl+0x8f6/0x1930\n sock_do_ioctl+0x110/0x260\n sock_ioctl+0x380/0x590\n __x64_sys_ioctl+0x134/0x1c0\n\n Freed by task 65:\n kfree+0x131/0x3c0\n rfcomm_dev_destruct+0x23b/0x2f0\n release_one_tty+0xc1/0x370\n process_one_work+0x661/0x1090\n\nUse test_and_set_bit() in both paths so that only the caller that changes\nRFCOMM_TTY_OWNED from clear to set drops the initial reference. Each path\nkeeps its own lookup reference until release or TTY cleanup, preserving\nthe existing callback ordering and error handling."
}
],
"lastModified": "2026-10-19T10:19:38.053",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}